Kurz gesagt
- CVE-2024-12215 ist eine Schwachstelle (HOCH (CVSS 8.8)) in kedro.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.1%, höher als bei 65.0% aller Schwachstellen.
- Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.
| Package | Affected versions | Patched versions |
|---|
| kedro PyPI | ≤ 0.19.8
| No fix yet |
Description
In kedro-org/kedro version 0.19.8, the pull_package() API function allows users to download and extract micro packages from the Internet. However, the function project_wheel_metadata() within the code path can execute the setup.py file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
NVD description
In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free