En bref
- CVE-2024-12215 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant kedro.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.1%, plus élevée que 65.0% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
| Package | Affected versions | Patched versions |
|---|
| kedro PyPI | ≤ 0.19.8
| No fix yet |
Description
In kedro-org/kedro version 0.19.8, the pull_package() API function allows users to download and extract micro packages from the Internet. However, the function project_wheel_metadata() within the code path can execute the setup.py file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
NVD description
In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free