—

PYSEC-2022-238

Quick fix

PYSEC-2022-238 — codecov: upgrade to the fixed version with the command below.

pip install --upgrade 'codecov>=2a80aa434f74feb31242b6f213b75ce63ae97902'

Details

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/codecov

Introduced in: 0Fixed in: 2a80aa434f74feb31242b6f213b75ce63ae97902

Fixpip install --upgrade 'codecov>=2a80aa434f74feb31242b6f213b75ce63ae97902'

References

https://snyk.io/vuln/SNYK-PYTHON-CODECOV-552149[ADVISORY]
https://github.com/codecov/codecov-python/commit/2a80aa434f74feb31242b6f213b75ce63ae97902[FIX]
https://github.com/advisories/GHSA-h3qr-fjhm-jphw[ADVISORY]