[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYuwbQyi1ppfm95x2A4QBYH1oh-o_8yGxlWZwlJOJk7o":3,"g5a-risk:CVE-2022-21668":187},{"success":4,"data":5,"meta":185},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":47,"epssPercentile":27,"epssTimeSeries":48,"severity":49,"affectedProducts":50,"affectedProductsCount":67,"references":68,"referencesCount":29,"weaknesses":94,"weaknessesCount":135,"isActivelyExploited":136,"cisaInfo":27,"otxData":27,"relatedBlogPosts":137,"seoMetadata":138,"configurations":163,"relatedVendorCves":183,"notableEvents":184},"CVE-2022-21668","What is CVE-2022-21668?","pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution\u002FRCE). When pip installs from a source distribution, any code in the setup.py is executed by the install process. This issue is patched in version 2022.1.8. The GitHub Security Advisory contains more information about this vulnerability.","pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files...","2022-01-10T21:15:07.853","2024-02-07T19:25:22.97",8.6,"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":27,"CVSSMetricV2":38,"CVSSMetricV40":27},[16,30],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":26,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","LOCAL","LOW","NONE","REQUIRED","CHANGED","HIGH",null,1.8,6,{"Source":31,"Type":32,"CVSSData":33,"ExploitabilityScore":37,"ImpactScore":29},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":34,"AttackVector":35,"AttackComplexity":26,"PrivilegesRequired":22,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":36,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":26,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H","NETWORK",8,1.3,[39],{"Source":17,"Type":18,"CVSSData":40,"BaseSeverity":26,"ExploitabilityScore":12,"ImpactScore":46,"ACInsufInfo":27,"ObtainAllPrivilege":27,"ObtainUserPrivilege":27,"ObtainOtherPrivilege":27,"UserInteractionRequired":4},{"Version":41,"VectorString":42,"AccessVector":35,"AccessComplexity":43,"Authentication":23,"ConfidentialityImpact":44,"IntegrityImpact":44,"AvailabilityImpact":44,"BaseScore":45,"BaseSeverity":27,"Exploitability":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"CollateralDamagePotential":27,"TargetDistribution":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"EnvironmentalScore":27},"2.0","AV:N\u002FAC:M\u002FAu:N\u002FC:C\u002FI:C\u002FA:C","MEDIUM","COMPLETE",9.3,10,0.03807,[47,47,47,47,47,47,47],"High",[51,56,61,64],{"vendor":52,"product":53,"version":54,"criteria":55,"vulnerable":4},"pypa","pipenv","*","cpe:2.3:a:pypa:pipenv:*:*:*:*:*:*:*:*",{"vendor":57,"product":58,"version":59,"criteria":60,"vulnerable":4},"fedoraproject","fedora","34","cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",{"vendor":57,"product":58,"version":62,"criteria":63,"vulnerable":4},"35","cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",{"vendor":57,"product":58,"version":65,"criteria":66,"vulnerable":4},"36","cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",4,[69,75,79,83,88,91],{"url":70,"source":71,"tags":72},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpipenv\u002Fcommit\u002F439782a8ae36c4762c88e43d5f0d8e563371b46f","GitHub",[73,74],"Patch","Third Party Advisory",{"url":76,"source":71,"tags":77},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpipenv\u002Freleases\u002Ftag\u002Fv2022.1.8",[78,74],"Release Notes",{"url":80,"source":71,"tags":81},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpipenv\u002Fsecurity\u002Fadvisories\u002FGHSA-qc9x-gjcv-465w",[82,74],"Exploit",{"url":84,"source":85,"tags":86},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce%40lists.fedoraproject.org\u002Fmessage\u002F56HBA3EOSLEDNCCBJVHE6DO34P56EOUM\u002F","Fedoraproject",[87],"Mailing List",{"url":89,"source":85,"tags":90},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce%40lists.fedoraproject.org\u002Fmessage\u002FKCROBYHUS6DKQPCXBRPCZ5CDBNQTYAWT\u002F",[87],{"url":92,"source":85,"tags":93},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce%40lists.fedoraproject.org\u002Fmessage\u002FQHQRIWKDP3SVJABAPEXBIQPKDI6UP7G4\u002F",[87],[95,103,109,115,120,125,131],{"id":96,"name":97,"description":98,"extendedDescription":99,"status":100,"abstraction":101,"structure":102},"CWE-190","Integer Overflow or Wraparound","The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","","Stable","Base","Simple",{"id":104,"name":105,"description":106,"extendedDescription":107,"status":100,"abstraction":108,"structure":102},"CWE-20","Improper Input Validation","The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","Input validation is a frequently-used technique\n\t   for checking potentially dangerous inputs in order to\n\t   ensure that the inputs are safe for processing within the\n\t   code, or when communicating with other components.  When\n\t   software does not validate input properly, an attacker is\n\t   able to craft the input in a form that is not expected by\n\t   the rest of the application. This will lead to parts of the\n\t   system receiving unintended input, which may result in\n\t   altered control flow, arbitrary control of a resource, or\n\t   arbitrary code execution.\nInput validation is not the only technique for\n\t   processing input, however.  Other techniques attempt to\n\t   transform potentially-dangerous input into something safe, such\n\t   as filtering (CWE-790) - which attempts to remove dangerous\n\t   inputs - or encoding\u002Fescaping (CWE-116), which attempts to\n\t   ensure that the input is not misinterpreted when it is included\n\t   in output to another component. Other techniques exist as well\n\t   (see CWE-138 for more examples.)\nInput validation can be applied to:\nData can be simple or structured.  Structured data\n\t   can be composed of many nested layers, composed of\n\t   combinations of metadata and raw data, with other simple or\n\t   structured data.\nMany properties of raw data or metadata may need\n\t   to be validated upon entry into the code, such\n\t   as:\nImplied or derived properties of data must often\n\t   be calculated or inferred by the code itself.  Errors in\n\t   deriving properties may be considered a contributing factor\n\t   to improper input validation.\nNote that \"input validation\" has very different\n\t   meanings to different people, or within different\n\t   classification schemes.  Caution must be used when\n\t   referencing this CWE entry or mapping to it.  For example,\n\t   some weaknesses might involve inadvertently giving control\n\t   to an attacker over an input when they should not be able\n\t   to provide an input at all, but sometimes this is referred\n\t   to as input validation.\nFinally, it is important to emphasize that the\n\t   distinctions between input validation and output escaping\n\t   are often blurred, and developers must be careful to\n\t   understand the difference, including how input validation\n\t   is not always sufficient to prevent vulnerabilities,\n\t   especially when less stringent data types must be\n\t   supported, such as free-form text. Consider a SQL injection\n\t   scenario in which a person's last name is inserted into a\n\t   query. The name \"O'Reilly\" would likely pass the validation\n\t   step since it is a common last name in the English\n\t   language. However, this valid name cannot be directly\n\t   inserted into the database because it contains the \"'\"\n\t   apostrophe character, which would need to be escaped or\n\t   otherwise transformed. In this case, removing the\n\t   apostrophe might reduce the risk of SQL injection, but it\n\t   would produce incorrect behavior because the wrong name\n\t   would be recorded.","Class",{"id":110,"name":111,"description":112,"extendedDescription":113,"status":114,"abstraction":101,"structure":102},"CWE-427","Uncontrolled Search Path Element","The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.","Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as \"\u002Ftmp\" or the current working directory.\nIn Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled:\nIn some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used.\nOne or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (\u002F) or its subdirectories (\u002Fetc, etc), or a code that recursively accesses the parent directory.  In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled.\nIn some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directory, which might be an untrusted search element.\nIn software package management frameworks (e.g., npm, RubyGems, or PyPi), the framework may identify dependencies on third-party libraries or other packages, then consult a repository that contains the desired package. The framework may search a public repository before a private repository. This could be exploited by attackers by placing a malicious package in the public repository that has the same name as a package from the private repository. The search path might not be directly under control of the developer relying on the framework, but this search order effectively contains an untrusted element.","Draft",{"id":116,"name":117,"description":118,"extendedDescription":119,"status":114,"abstraction":108,"structure":102},"CWE-77","Improper Neutralization of Special Elements used in a Command ('Command Injection')","The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.","Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.",{"id":121,"name":122,"description":123,"extendedDescription":124,"status":100,"abstraction":101,"structure":102},"CWE-78","Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications. Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage.\nThere are at least two subtypes of OS command injection:\nFrom a weakness standpoint, these variants represent distinct programmer errors. In the first variant, the programmer clearly intends that input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input.",{"id":126,"name":127,"description":128,"extendedDescription":129,"status":130,"abstraction":101,"structure":102},"CWE-1284","Improper Validation of Specified Quantity in Input","The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.","Specified quantities include size, length, frequency, price, rate, number of operations, time, and others. Code may rely on specified quantities to allocate resources, perform calculations, control iteration, etc. When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.","Incomplete",{"id":132,"name":133,"description":134,"extendedDescription":99,"status":130,"abstraction":101,"structure":102},"CWE-791","Incomplete Filtering of Special Elements","The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.",7,false,[],{"title":139,"metaDescription":140,"keywords":141,"canonicalUrl":142,"structuredData":143},"What is CVE-2022-21668? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2022-21668, a high severity cyber security vulnerability from 2022. pipenv is a Python development workflow tool. Starting with...","CVE-2022-21668, CVE-2022-21668 vulnerability, CVE-2022-21668 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, pypa security, fedoraproject security, pipenv vulnerability, fedora vulnerability","\u002Fwhat-is\u002Fcve-2022-21668",{"@context":144,"@type":145,"headline":139,"description":140,"datePublished":10,"dateModified":11,"author":146,"publisher":150,"about":154,"mainEntityOfPage":158,"articleSection":161,"keywords":162},"https:\u002F\u002Fschema.org","TechArticle",{"@type":147,"name":148,"url":149},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":147,"name":148,"url":149,"logo":151},{"@type":152,"url":153},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":155,"name":6,"description":156,"additionalType":157},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":159,"@id":160},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2022-21668","Cybersecurity","CVE-2022-21668, CVE-2022-21668 vulnerability, CVE-2022-21668 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[164,173],{"Operator":27,"Negate":27,"Nodes":165},[166],{"Operator":167,"Negate":27,"CPEMatch":168},"OR",[169],{"Vulnerable":4,"Criteria":55,"MatchCriteriaID":170,"VersionStartExcluding":27,"VersionStartIncluding":171,"VersionEndExcluding":172,"VersionEndIncluding":27},"1E34F343-93E1-4EB7-A3AC-C89D14AA14EF","2018.10.9","2022.1.8",{"Operator":27,"Negate":27,"Nodes":174},[175],{"Operator":167,"Negate":27,"CPEMatch":176},[177,179,181],{"Vulnerable":4,"Criteria":60,"MatchCriteriaID":178,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"A930E247-0B43-43CB-98FF-6CE7B8189835",{"Vulnerable":4,"Criteria":63,"MatchCriteriaID":180,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"80E516C0-98A4-4ADE-B69F-66A772E2BAAA",{"Vulnerable":4,"Criteria":66,"MatchCriteriaID":182,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD",[],[],{"lastModified":11,"cacheTime":186,"version":41},1792368433223,{"score":188,"band":189,"action":190,"scoredAt":191},50,"Medium","Plan remediation","2026-10-16T06:52:56.407876+00:00"]