Denial of Service Vulnerability in Wheel by Python Packaging Authority
CVE-2022-40898

7.5HIGH

Key Information:

Vendor

Wheel Project

Status
Wheel
Vendor
CVE Published:
23 December 2022

What is CVE-2022-40898?

A vulnerability exists in the Wheel package by the Python Packaging Authority (PyPA), affecting versions 0.37.1 and earlier. This issue enables remote attackers to exploit the command line interface (CLI) by supplying malicious input, which can lead to a denial of service, rendering the application unresponsive. Developers using this package should update to patched versions to mitigate the risk and safeguard their applications against potential exploitation.

References

https://pypi.org/project/wheel/
https://github.com/pypa/wheel/blob/main/src/wheel/wheelfi...
https://pyup.io/posts/pyup-discovers-redos-vulnerabilitie...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.