CVE-2022-24065 (High) detected in cookiecutter-1.7.3-py2.py3-none-any.whl

[mend-bolt-for-github]

CVE-2022-24065 - High Severity Vulnerability

Vulnerable Library - cookiecutter-1.7.3-py2.py3-none-any.whl

A command-line utility that creates projects from project templates, e.g. creating a Python package project from a Python package project template.

Library home page: https://files.pythonhosted.org/packages/a2/62/d061b19f307455506e63825586e2e1816b71d56b4a5873c278cb315b9660/cookiecutter-1.7.3-py2.py3-none-any.whl

Path to dependency file: /docs/requirements.txt

Path to vulnerable library: /docs/requirements.txt

Dependency Hierarchy:

• ❌ cookiecutter-1.7.3-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 8d0a10402c32fdfadb3cf3eed011045fb6bdc1fb

Found in base branch: master

Vulnerability Details

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Publish Date: 2022-06-08

URL: CVE-2022-24065

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24065

Release Date: 2022-06-08

Fix Resolution: 2.1.1

---

Step up your Open Source Security Game with Mend here

[github-actions]

👋 Thanks for reporting!