{"id":"GSD-2022-1002521","aliases":["PYSEC-2022-199"],"status":"published","title":"backdoor in ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6","description":"In PyPI ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6 a backdoor exists in the ctx package that can be attacked via a malicious package update resulting in credential theft from environment variables","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2022-05-24T16:49:59.126662Z","modified":"2023-11-08T04:24:37Z","affected":[{"source":"osv","ecosystem":"PyPI","package":"ctx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.2-1"}]}],"versions":["0.1.2-1","0.1.2-2","0.1.4","0.2","0.2.1","0.2.2","0.2.2.1","0.2.3","0.2.4","0.2.5","0.2.6"]}],"references":[{"url":"https://isc.sans.edu/diary/28678","tags":["web"]},{"url":"https://blog.sonatype.com/pypi-package-ctx-compromised-are-you-at-risk","tags":["web"]},{"url":"https://github.com/github/advisory-database/issues/325","tags":["web"]},{"url":"https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html","tags":["article"]},{"url":"https://github.com/pypa/advisory-database/blob/main/vulns/ctx/PYSEC-2022-199.yaml","tags":["advisory"]}],"sources":{"osv":[{"id":"GSD-2022-1002521","title":"backdoor in ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6","description":"In PyPI ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6 a backdoor exists in the ctx package that can be attacked via a malicious package update resulting in credential theft from environment variables","status":"withdrawn","published":"2022-05-24T16:49:59.126662Z","modified":"2023-11-08T04:24:37.303329Z","updated_at":"2026-11-02T15:47:07.529429Z"},{"id":"PYSEC-2022-199","description":"The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.","status":"published","published":"2022-05-24T17:55:00Z","modified":"2023-11-08T04:24:37.303329Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}