Bug 2047813 (CVE-2022-21699)

Summary: CVE-2022-21699 ipython: arbitrary code execution by cross user temporary files mismanagment
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dcantrell, jwong, kaycoth, lbalhar, mhroncok, michel, mrunge, orion, python-sig, rfreiman, tomspur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ipython 8.0.1, ipython 7.31.1, ipython 7.16.3 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2047814, 2047815, 2048252, 2135164    
Bug Blocks: 2047816    

Description Marian Rehak 2022-01-28 15:44:23 UTC 
Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.

Reference:

https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
Comment 1 Marian Rehak 2022-01-28 15:44:50 UTC 
Created ipython tracking bugs for this issue:

Affects: epel-all [bug 2047815]
Affects: fedora-all [bug 2047814]