Summary
It was discovered that tqdm did not properly sanitize non-boolean CLI
Arguments. A local attacker could possibly use this issue to execute
arbitrary code on the host. This issue only affected Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2024-34062)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | tqdm | 4.57.0-2ubuntu0.1~esm2 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | tqdm | 4.66.2-2ubuntu0.1~esm1 |
Vulnerabilities 1
-
Medium 4.8
tqdm CLI arguments injection attack
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had be…
References
-
report
https://ubuntu.com/security/CVE-2024-34062