CVE-2022-21797
Fixed in a distro release EPSS 3%CVSS 7.3
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Products: fedoraproject fedora, debian_linux, joblib_project joblib
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | joblib | 1.2.0 |
| PyPI | joblib | b90f10efeb670a2cc877fb88ebb3f2019189e059 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | joblib | 0.13.0-2+deb10u2 |
| Debian 12 | joblib | 1.2.0-1 |
| Debian 13 | joblib | 1.2.0-1 |
| Debian 14 | joblib | 1.2.0-1 |
| SUSE Package Hub 15 SP3 | python-joblib | 0.16.0-bp153.2.3.1 |
| Ubuntu 14.04 LTS | joblib | no fix |
| Ubuntu 16.04 LTS | joblib | no fix |
| Ubuntu 18.04 LTS | joblib | no fix |
| Ubuntu 20.04 LTS | joblib | no fix |
| Ubuntu 22.04 LTS | joblib | no fix |
| openSUSE Leap 15.3 | python-joblib | 0.16.0-bp153.2.3.1 |
| openSUSE Tumbleweed | python-joblib | 1.4.2-2.1 |