CVE-2022-30877

Advisory

Keep 1.2 included a code-execution backdoor inserted by a third party.
https://www.bleepingcomputer.com/news/security/pypi-package-keep-mistakenly-included-a-password-stealer

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2. See CVE-2022-30877.


MISC:http://pypi.doubanio.com/simple/request: http://pypi.doubanio.com/simple/request
MISC:https://github.com/OrkoHunter/keep/issues/85: https://github.com/OrkoHunter/keep/issues/85
MISC:https://pypi.org/project/keep: https://pypi.org/project/keep

Resources

• http://pypi.doubanio.com/simple/request
• https://github.com/OrkoHunter/keep/issues/85
• https://pypi.org/project/keep
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30877