—

PYSEC-2022-17

Quick fix

PYSEC-2022-17 — gerapy: upgrade to the fixed version with the command below.

pip install --upgrade 'gerapy>=0.9.9'

Details

Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/gerapy

Introduced in: 0Fixed in: 0.9.9

Fixpip install --upgrade 'gerapy>=0.9.9'

References

https://securitylab.github.com/advisories/GHSL-2021-076-gerapy/[ADVISORY]
https://github.com/Gerapy/Gerapy/issues/197[REPORT]
https://github.com/Gerapy/Gerapy/security/advisories/GHSA-756h-r2c9-qp5j[ADVISORY]
https://lgtm.com/projects/g/Gerapy/Gerapy?mode=tree&ruleFocus=1505994646253[WEB]
https://github.com/Gerapy/Gerapy/issues/217[REPORT]