GHSA-74w3-2r77-fw5h

Source

https://github.com/advisories/GHSA-74w3-2r77-fw5h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-74w3-2r77-fw5h/GHSA-74w3-2r77-fw5h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-74w3-2r77-fw5h

Aliases

CVE-2022-27177
PYSEC-2022-189

Published

2022-04-03T00:00:58Z

Modified

2025-02-18T05:27:54Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Use of Externally-Controlled Format String in consoleme

Details

A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2

Database specific

{
    "cwe_ids":  [
        "CWE-134"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-04-05T17:54:33Z",
    "nvd_published_at":  "2022-04-01T23:15:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

PyPI / consoleme

Package

Name: consoleme; View open source insights on deps.dev
Purl: pkg:pypi/consoleme

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.2.2

Affected versions

0.*

0.0.0

1.*

1.0.6.dev10

1.1.1

1.1.2.dev1

1.1.2

1.1.3.dev1

1.1.3.dev2

1.1.3.dev3

1.1.3.dev4

1.1.3.dev5

1.1.3.dev6

1.1.3.dev7

1.1.3.dev8

1.1.3

1.1.4

1.1.5.dev1

1.1.5.dev2

1.1.5.dev3

1.1.5

1.1.6.dev1

1.1.6.dev2

1.1.6

1.1.7

1.1.8.dev1

1.1.8.dev2

1.1.8.dev3

1.1.8.dev4

1.1.8

1.1.9.dev1

1.1.9

1.1.10.dev1

1.1.10.dev2

1.1.10.dev3

1.1.10.dev4

1.1.10.dev5

1.1.10.dev6

1.2.0

1.2.1.dev1

1.2.1

1.2.2.dev3

1.2.2.dev4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-74w3-2r77-fw5h/GHSA-74w3-2r77-fw5h.json"