CVE-2022-21699

Published: 19 January 2022

IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.

Priority

Cvss 3 Severity Score

8.8

Score breakdown

Status

Package	Release	Status
ipython Launchpad, Ubuntu, Debian	bionic	Released (5.5.0-1ubuntu0.1~esm1) Available with Ubuntu Pro
	focal	Released (7.13.0-1ubuntu0.1~esm1) Available with Ubuntu Pro
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Not vulnerable (7.31.1-1)
	kinetic	Not vulnerable (7.31.1-1)
	lunar	Not vulnerable (8.5.0-4)
	mantic	Not vulnerable (8.5.0-4)
	trusty	Ignored (changes too intrusive)
	upstream	Released (8.0.1, 7.31.1, 5.11)
	xenial	Ignored (changes too intrusive)
	Patches: upstream: https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668

Severity score breakdown

Parameter	Value
Base score	8.8
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Changed
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›