What is GHSA-v4f4-23wc-99mh?

GHSA-v4f4-23wc-99mh is a security advisory published by GitHub Security Advisories with Critical severity. pipreqs vulnerable to Dependency Confusion

Which CVE IDs does GHSA-v4f4-23wc-99mh cover?

GHSA-v4f4-23wc-99mh covers the following CVE IDs: CVE-2023-31543. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v4f4-23wc-99mh?

GHSA-v4f4-23wc-99mh has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-v4f4-23wc-99mh?

GHSA-v4f4-23wc-99mh affects 1 product, including: pip/pipreqs:\u003e= 0.3.0, \u003c 0.4.12.

GHSA-v4f4-23wc-99mhCriticalCVSS 9.8

pipreqs vulnerable to Dependency Confusion

Vendor

GitHub Security Advisories

Published

June 30, 2023

Last Modified

October 11, 2024

🔗 CVE IDs covered (1)

CVE-2023-31543 →

📋 Description

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.

🎯 Affected products1

pip/pipreqs:>= 0.3.0, < 0.4.12

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2023-31543
https://github.com/bndr/pipreqs/pull/364
https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe
https://github.com/bndr/pipreqs/commit/3f5964fcb90ec6eb6df46d78e651a1b73538d0ba
https://github.com/bndr/pipreqs/blob/master/pipreqs/pipreqs.py#L447-L449
https://github.com/pypa/advisory-database/tree/main/vulns/pipreqs/PYSEC-2023-99.yaml
https://github.com/advisories/GHSA-v4f4-23wc-99mh