CRITICAL9.8

PYSEC-2022-43163

Quick fix

PYSEC-2022-43163 — reqmon: upgrade to the fixed version with the command below.

pip install --upgrade 'reqmon>=2.0.4'

Details

WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/reqmon

Introduced in: 1.4.1rc5Fixed in: 2.0.4

Fixpip install --upgrade 'reqmon>=2.0.4'

References

https://github.com/dmwm/WMCore/issues/11188[EVIDENCE]
https://github.com/dmwm/WMCore/issues/11188[REPORT]