CVE-2022-35861
- Source
- https://cve.org/CVERecord?id=CVE-2022-35861
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-35861.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-35861
- Downstream
openSUSE (2)
- Related
- Published
- 2022-07-17T16:31:03Z
- Modified
- 2026-10-22T10:35:41Z
- Summary
- [none]
- Details
-
pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.)
- Database specific
{ "cna_assigner": "mitre", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35861.json" }- References
Affected packages
Git / github.com/pyenv/pyenv
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pyenv/pyenv
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:pyenv:pyenv:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.2.24" }, { "last_affected": "2.3.2" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "22fa683571d98b59ea16e5fe48ac411c67939653" } ], "source": "REFERENCES_COMMIT" } ] }