---

Gentoo Linux Security Advisory GLSA 202401-01

---

                                       https://security.gentoo.org/  

---

Severity: High
Title: Joblib: Arbitrary Code Execution
Date: January 02, 2024
Bugs: #873151
ID: 202401-01

---

Synopsis

A vulnerability has been found in Joblib which allows for arbitrary code
execution.

Background

Joblib is a set of tools to provide lightweight pipelining in Python. In
particular:

1. transparent disk-caching of functions and lazy re-evaluation (memoize
   pattern)
2. easy simple parallel computing

Joblib is optimized to be fast and robust on large data in particular
and has specific optimizations for numpy arrays.

Affected packages

Package Vulnerable Unaffected

---

dev-python/joblib < 1.2.0 >= 1.2.0

Description

A vulnerability has been discovered in Joblib. Please review the CVE
identifier referenced below for details.

Impact

Joblib is vulnerable to arbitrary code execution via the pre_dispatch
flag in Parallel() class due to the eval() statement.

Workaround

There is no known workaround at this time.

Resolution

All Joblib users should upgrade to the latest version:

emerge --sync

emerge --ask --oneshot --verbose “>=dev-python/joblib-1.2.0”

References

[ 1 ] CVE-2022-21797
https://nvd.nist.gov/vuln/detail/CVE-2022-21797

Availability

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202401-01

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.

License

Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5