CVE-2021-3840

Description

A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.

How to fix CVE-2021-3840

To remediate CVE-2021-3840, upgrade the affected package to a fixed version below.

• —upgrade to 1.0.1 or later
• —upgrade to 1.0.1 or later

Is CVE-2021-3840 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 1.0.1
• from 0, < 1.0.1

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-3840
• PATCHgithub.com/lenovo/Antilles
• WEBgithub.com/lenovo/Antilles/commit/c7b9c5740908b343aceefe69733d9972e64df0b9
• WEBgithub.com/lenovo/Antilles/security/advisories/GHSA-hgc3-hp6x-wpgx