CVE-2022-21699: debian debian_linux Execution with Unnecessary Privileges
CVSS: 8.8v3.1HighModified
AliasesMGASA-2023-0058openSUSE-SU-2022:10043-1GHSA-pq7m-3gw7-gq5xPYSEC-2022-12UBUNTU-CVE-2022-21699DEBIAN-CVE-2022-21699DLA-2896-1DSA-5065-1CGA-xfv4-7wpg-874ropenSUSE-SU-2025:14718-1
Published 19-01-2022Last modified 22-04-2025
Vulnerability summary
CVE-2022-21699 is a high (CVSS 8.8) Execution with Unnecessary Privileges vulnerability in debian debian_linux. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
0.65%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 1 · Related 3Timeline
- 19-01-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
CVSS metrics
9 scores · 7 sources · 3 versionsCritical 9.3Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:PSourcesSingle source
High 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSources7 sources · 8.2–8.8
- CVE.orgCNA8.2HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · PypiEcosystem advisory · calculated8.2HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HDiffers
Medium 4.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
0.00 pp
From 0.65% on 20-09-2026
20-09-202620-10-2026
EPSS score0.65%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIpython
Maturity: poc
Weaknesses
CWE · root cause- CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
- CWE-279Incorrect Execution-Assigned PermissionsWhile it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Opensuse3 products
- python-ipython-test&distro=openSUSE Leap 15.3< 7.13.0-bp153.2.6.6
- python-ipython&distro=openSUSE Leap 15.3< 7.13.0-bp153.2.6.1
- python-ipython&distro=openSUSE Tumbleweed< 8.31.0-1.1
Debian2 products
- ipython< 5.8.0-1+deb10u1 | < 7.20.0-1+deb11u1 | < 5.1.0-3+deb9u1 | < 7.31.1-1
- debian_linuxEOL9.0 | 10.0 | 11.0
Suse2 products
- python-ipython-test&distro=SUSE Package Hub 15 SP3< 7.13.0-bp153.2.6.6
- python-ipython&distro=SUSE Package Hub 15 SP3< 7.13.0-bp153.2.6.1
Chainguard1 product
- kubeflow-pipelines-visualization-server< 2.4.0-r0
Fedoraproject1 product
- fedoraEOL34 | 35
Ipython1 product
- ipython< 5.11 | ≤ 5.10.0 | ≥ 6.0.0, < 7.16.3 | ≥ 7.17.0, < 7.31.1 | ≥ 8.0.0, < 8.0.1
Mageia1 product
- ipython< 7.31.1-1.mga8
PyPI1 product
- ipython< 5.11 | ≥ 6.0.0, < 7.16.3 | ≥ 7.17.0, < 7.31.1 | < 46a51ed69cdf41b4333943d9ceeb945c4ede5668 | ≥ 8.0.0, < 8.0.1
Ubuntu1 product
- ipythonAll versions (No fix recorded) | < 5.5.0-1ubuntu0.1~esm1 | < 7.13.0-1ubuntu0.1~esm1
Wolfi1 product
- kubeflow-pipelines-visualization-server< 2.4.0-r0
10 vendors · 14 products
References
29 links- github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5xX Refsource CONFIRMWEBAdvisoryREPORTExploitThird Party Advisory
- github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668X Refsource MISCWEBFIXREPORTPatchThird Party Advisory
- ipython.readthedocs.io/en/stable/whatsnew/version8.htmlX Refsource MISCWEBREPORTRelease NotesThird Party Advisory
lists.debian.org/debian-lts-announce/2022/01/msg00021.htmlMailing ListX Refsource MLISTWEBARTICLEThird Party Advisory
Show all 29 references
- github.com/ipython/ipythonPACKAGE
- lists.opensuse.org/archives/…Advisory