Vulnerability Description
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cookiecutter Project | Cookiecutter | < 2.1.1 |
| Fedoraproject | Fedora | 35 |
Related Weaknesses (CWE)
References
- https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531fPatchThird Party Advisory
- https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281ExploitPatchThird Party Advisory
- https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531fPatchThird Party Advisory
- https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281ExploitPatchThird Party Advisory
FAQ
What is CVE-2022-24065?
CVE-2022-24065 is a vulnerability with a CVSS score of 8.1 (HIGH). The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed t...
How severe is CVE-2022-24065?
CVE-2022-24065 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-24065?
Check the references section above for vendor advisories and patch information. Affected products include: Cookiecutter Project Cookiecutter, Fedoraproject Fedora.