CVE-2022-21699

HIGH
Published Jan 19, 20224y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Jan 19, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.

CVSS Details

Base Score
8.8
Exploitability
2.0
Impact
6.0
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 3

CWE-250
CWE-269 Improper Privilege Management Authorization
CWE-279

Affected Products 9

VendorProductVersionRange
ipythonipython* ≤5.10.0
ipythonipython*≥6.0.0  –  <7.16.3
ipythonipython*≥7.17.0  –  <7.31.1
ipythonipython*≥8.0.0  –  <8.0.1
debiandebian_linux9.0any
debiandebian_linux10.0any
debiandebian_linux11.0any
fedoraprojectfedora34any
fedoraprojectfedora35any

References 6

  • github.com https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668
    PatchThird Party Advisory
  • github.com https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
    ExploitThird Party Advisory
  • ipython.readthedocs.io https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699
    Release NotesThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/01/msg00021.html
    Mailing ListThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/

Remediation

  • github.com https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668
    PatchThird Party Advisory