Description

Withdrawn

This advisory has been withdrawn after the maintainers of loguru noted this issue is not a security vulnerability and the CVE has been revoked. We have stopped Dependabot alerts regarding this issue.

Original Description

In versions of loguru up to and including 0.5.3 a lack of sanitization on log serialization can lead to arbitrary code execution. The maintainer disputes the issue, but has altered behavior of the library in commit 4b0070a4f30cbf6d5e12e6274b242b62ea11c81b. See https://github.com/Delgan/loguru/issues/563 for further discussion of the issue. The function in question is intended for internal use only, but is not restricted. This has been patched in version 0.6.0.

Basic information

Type: reviewed
Severity: low
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2022-01-28 22:01:45 UTC
Updated: 2023-02-03 05:05:17 UTC
GitHub reviewed: 2022-01-25 23:33:20 UTC
NVD published: 2022-01-21
Withdrawn: 2022-02-01 15:17:33 UTC

Score	Percentile
0.04%	14.51%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type	Value
GHSA	GHSA-cvp7-c586-cmf4 ↗
CVE	CVE-2022-0329 ↗

CWEs

CWE id	Name
CWE-94	Improper Control of Generation of Code ('Code Injection')

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
pip	loguru	<= 0.5.3	0.6.0	—

Withdrawn: Code Injection in loguru