CVE-2022-21699
CVE-2022-21699 · Execution with Unnecessary Privileges in ipython
This page contains facts from public vulnerability sources. Check the original advisory before updating.
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
CVSS 8.2 · High · EPSS 0.7% · Fix available
- Published
- Updated
Affected products and versions
ipython
- Versions
- < 5.11: Affected
- >= 6.0.0, < 7.16.3: Affected
- >= 7.17.0, < 7.31.1: Affected
- >= 8.0.0, < 8.0.1: Affected
No fix published
ipython Debian:12
- Affected ranges
- ECOSYSTEM: < 7.31.1-1
Update to 7.31.1-1
ipython Debian:13
- Affected ranges
- ECOSYSTEM: < 7.31.1-1
Update to 7.31.1-1
ipython Debian:14
- Affected ranges
- ECOSYSTEM: < 7.31.1-1
Update to 7.31.1-1
ipython PyPI
- Versions
- 0.10
- 0.10.1
- 0.10.2
- 0.11
- 0.12
- 0.12.1
- 0.13
- 0.13.1
- 0.13.2
- 0.6.10
- 0.6.11
- 0.6.12
- 0.6.13
- 0.6.14
- 0.6.15
- 0.6.4
- 0.6.5
- 0.6.6
- 0.6.7
- 0.6.8
- 0.6.9
- 0.7.0
- 0.7.1
- 0.7.1.fix1
- 0.7.2
- 0.7.3
- 0.7.4.svn.r2010
- 0.8.0
- 0.8.1
- 0.8.2
- 0.8.3
- 0.8.4
- 0.9
- 0.9.1
- 1.0.0
- 1.1.0
- 1.2.0
- 1.2.1
- 2.0.0
- 2.1.0
- 2.2.0
- 2.3.0
- 2.3.1
- 2.4.0
- 2.4.1
- 3.0.0
- 3.1.0
- 3.2.0
- 3.2.1
- 3.2.2
- 3.2.3
- 4.0.0
- 4.0.0-b1
- 4.0.0b1
- 4.0.1
- 4.0.2
- 4.0.3
- 4.1.0
- 4.1.0rc1
- 4.1.0rc2
- 4.1.1
- 4.1.2
- 4.2.0
- 4.2.1
- 5.0.0
- 5.0.0b1
- 5.0.0b2
- 5.0.0b3
- 5.0.0b4
- 5.0.0rc1
- 5.1.0
- 5.10.0
- 5.2.0
- 5.2.1
- 5.2.2
- 5.3.0
- 5.4.0
- 5.4.1
- 5.5.0
- 5.6.0
- 5.7.0
- 5.8.0
- 5.9.0
- Affected ranges
- ECOSYSTEM: < 5.11
Update to 5.11
ipython PyPI
- Versions
- 6.0.0
- 6.1.0
- 6.2.0
- 6.2.1
- 6.3.0
- 6.3.1
- 6.4.0
- 6.5.0
- 7.0.0
- 7.0.0b1
- 7.0.0rc1
- 7.0.1
- 7.1.0
- 7.1.1
- 7.10.0
- 7.10.1
- 7.10.2
- 7.11.0
- 7.11.1
- 7.12.0
- 7.13.0
- 7.14.0
- 7.15.0
- 7.16.0
- 7.16.1
- 7.16.2
- 7.2.0
- 7.3.0
- 7.4.0
- 7.5.0
- 7.6.0
- 7.6.1
- 7.7.0
- 7.8.0
- 7.9.0
- Affected ranges
- ECOSYSTEM: ≥ 6.0.0, < 7.16.3
Update to 7.16.3
ipython PyPI
- Versions
- 7.17.0
- 7.18.0
- 7.18.1
- 7.19.0
- 7.20.0
- 7.21.0
- 7.22.0
- 7.23.0
- 7.23.1
- 7.24.0
- 7.24.1
- 7.25.0
- 7.26.0
- 7.27.0
- 7.28.0
- 7.29.0
- 7.30.0
- 7.30.1
- 7.31.0
- Affected ranges
- ECOSYSTEM: ≥ 7.17.0, < 7.31.1
Update to 7.31.1
ipython PyPI
- Versions
- 8.0.0
- Affected ranges
- ECOSYSTEM: ≥ 8.0.0, < 8.0.1
Update to 8.0.1
ipython PyPI
- Versions
- 0.10
- 0.10.1
- 0.10.2
- 0.11
- 0.12
- 0.12.1
- 0.13
- 0.13.1
- 0.13.2
- 0.6.10
- 0.6.11
- 0.6.12
- 0.6.13
- 0.6.14
- 0.6.15
- 0.6.4
- 0.6.5
- 0.6.6
- 0.6.7
- 0.6.8
- 0.6.9
- 0.7.0
- 0.7.1
- 0.7.1.fix1
- 0.7.2
- 0.7.3
- 0.7.4.svn.r2010
- 0.8.0
- 0.8.1
- 0.8.2
- 0.8.3
- 0.8.4
- 0.9
- 0.9.1
- 1.0.0
- 1.1.0
- 1.2.0
- 1.2.1
- 2.0.0
- 2.1.0
- 2.2.0
- 2.3.0
- 2.3.1
- 2.4.0
- 2.4.1
- 3.0.0
- 3.1.0
- 3.2.0
- 3.2.1
- 3.2.2
- 3.2.3
- 4.0.0
- 4.0.0-b1
- 4.0.0b1
- 4.0.1
- 4.0.2
- 4.0.3
- 4.1.0
- 4.1.0rc1
- 4.1.0rc2
- 4.1.1
- 4.1.2
- 4.2.0
- 4.2.1
- 5.0.0
- 5.0.0b1
- 5.0.0b2
- 5.0.0b3
- 5.0.0b4
- 5.0.0rc1
- 5.1.0
- 5.10.0
- 5.2.0
- 5.2.1
- 5.2.2
- 5.3.0
- 5.4.0
- 5.4.1
- 5.5.0
- 5.6.0
- 5.7.0
- 5.8.0
- 5.9.0
- 6.0.0
- 6.1.0
- 6.2.0
- 6.2.1
- 6.3.0
- 6.3.1
- 6.4.0
- 6.5.0
- 7.0.0
- 7.0.0b1
- 7.0.0rc1
- 7.0.1
- 7.1.0
- 7.1.1
- 7.10.0
- 7.10.1
- 7.10.2
- 7.11.0
- 7.11.1
- 7.12.0
- 7.13.0
- 7.14.0
- 7.15.0
- 7.16.0
- 7.16.1
- 7.16.2
- 7.17.0
- 7.18.0
- 7.18.1
- 7.19.0
- 7.2.0
- 7.20.0
- 7.21.0
- 7.22.0
- 7.23.0
- 7.23.1
- 7.24.0
- 7.24.1
- 7.25.0
- 7.26.0
- 7.27.0
- 7.28.0
- 7.29.0
- 7.3.0
- 7.30.0
- 7.30.1
- 7.31.0
- 7.4.0
- 7.5.0
- 7.6.0
- 7.6.1
- 7.7.0
- 7.8.0
- 7.9.0
- 8.0.0
- Affected ranges
- GIT: < 46a51ed69cdf41b4333943d9ceeb945c4ede5668
- ECOSYSTEM: < 6.0.0rc1 ∪ ≥ 6.0.0, < 7.16.3 ∪ ≥ 7.17.0, < 7.31.1 ∪ ≥ 8.0.0, < 8.0.1
Update to 6.0.0rc1; Update to 7.16.3; Update to 7.31.1; Update to 8.0.1
ipython Ubuntu:Pro:14.04:LTS
- Versions
- 0.13.2-2
- 1.1.0-1
- 1.2.0~rc1-1
- 1.2.1-2
- 1.2.1-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ipython Ubuntu:Pro:16.04:LTS
- Versions
- 2.3.0-2ubuntu1
- 2.3.0-2ubuntu2
- 2.4.1-1
- 2.4.1-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ipython Ubuntu:Pro:18.04:LTS
- Versions
- 5.1.0-3
- 5.5.0-1
- Affected ranges
- ECOSYSTEM: < 5.5.0-1ubuntu0.1~esm1
Update to 5.5.0-1ubuntu0.1~esm1
ipython Ubuntu:Pro:20.04:LTS
- Versions
- 5.8.0-1
- 5.8.0-1build1
- 5.8.0-2
- 7.12.0-1
- 7.13.0-1
- Affected ranges
- ECOSYSTEM: < 7.13.0-1ubuntu0.1~esm1
Update to 7.13.0-1ubuntu0.1~esm1
Original sources
- https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
- https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668
- https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699
- https://lists.debian.org/debian-lts-announce/2022/01/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/
- https://nvd.nist.gov/vuln/detail/CVE-2022-21699