PT-2022-25547 · Pypi · Democritus-Hypothesis+1
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
d8s-dates version 0.1.0
Description
The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package.
Recommendations
For version 0.1.0, avoid using the democritus-hypothesis package until a patch is available. As a temporary workaround, consider removing or disabling the democritus-hypothesis package to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
D8S-Dates
Democritus-Hypothesis