In breve
- CVE-2024-12215 è una vulnerabilità ALTO (CVSS 8.8) che riguarda kedro.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 65.0% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
| Package | Affected versions | Patched versions |
|---|
| kedro PyPI | ≤ 0.19.8
| No fix yet |
Description
In kedro-org/kedro version 0.19.8, the pull_package() API function allows users to download and extract micro packages from the Internet. However, the function project_wheel_metadata() within the code path can execute the setup.py file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
NVD description
In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free