[ GLSA 201807-01 ] tqdm

[GLSA]

Gentoo Linux Security Advisory

Title: tqdm: Arbitrary code execution (GLSA 201807-01)
Severity: normal
Exploitable: remote
Date: 2018-07-18
Bug(s): #636384
ID: 201807-01

Synopsis

A vulnerability in tqdm could allow remote attackers to execute
arbitrary code.


Background

tqdm is a smart progress meter.

Affected Packages

Package: dev-python/tqdm
Vulnerable: < 4.23.3
Unaffected: >= 4.23.3
Architectures: All supported architectures


Description

A vulnerablility was discovered in tqdm._version that could allow a
malicious git log within the current working directory.


Impact

A remote attacker could execute arbitrary commands by enticing a user to
clone a crafted repo.


Workaround

There is no known workaround at this time.

Resolution

All tqdm users should upgrade to the latest version: