CVE-2022-42042
EPSS 0.47%
Description
The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hashes package. The affected version is 0.1.0.
How to fix CVE-2022-42042
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- PyPI/d8s-networking—no fix listed
- PyPI/democritus-hashes—no fix listed
Is CVE-2022-42042 being exploited?
Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0
- from 0