PYSEC-2022-199

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/ctx/PYSEC-2022-199.yaml

Aliases

• GSD-2022-1002521

Published

2022-05-24T17:55:00Z

Modified

2023-11-08T04:24:37.303329Z

Details

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.

References

• https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html