Bug 831510 (CVE-2022-21699)

Summary:	<dev-python/ipython-{7.31.1,8.0.1}: potential Execution with Unnecessary Privileges
Product:	Gentoo Security	Reporter:	Michał Górny <mgorny>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	minor	CC:	python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [glsa? cleanup]
Package list:		Runtime testing required:	---
Bug Depends on:	831511
Bug Blocks:

Description Michał Górny archtester

2022-01-19 22:25:22 UTC

IPython 8.0.1 (CVE-2022-21699)
------------------------------

IPython 8.0.1, 7.31.1 and 5.11 are security releases that change some default
values in order to prevent potential Execution with Unnecessary Privileges.

Almost all version of IPython looks for configuration and profiles in current
working directory. Since IPython was developed before pip and environments
existed it was used a convenient way to load code/packages in a project
dependant way.

In 2022, it is not necessary anymore, and can lead to confusing behavior where
for example cloning a repository and starting IPython or loading a notebook from
any Jupyter-Compatible interface that has ipython set as a kernel can lead to
code execution.

Comment 1 John Helmert III archtester

2022-01-19 23:50:58 UTC

Thank you for reporting!

Comment 2 Michał Górny archtester

2022-01-20 14:03:20 UTC

cleanup done.