CVE-2002-1119 os._execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names, which could allow local users to execute arbitrary code via a symlink attack.
MediumCVSS 4.6
EPSS 0.49%
- Published
- Updated
- Exploit status
- No public exploit known
Description
os._execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names, which could allow local users to execute arbitrary code via a symlink attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python | < 2.2.2 | 2.2.2 |
References
- CLA-2002:527 third-party-advisory vendor-advisory
- mail.python.org mailing-list vendor-advisory
- 20030123 [OpenPKG-SA-2003.006] OpenPKG Security Advisory (python) mailing-list
- DSA-159 patch vendor-advisory
- python-execvpe-tmpfile-symlink(10009) vdb-entry vendor-advisory
- MDKSA-2002:082 third-party-advisory vendor-advisory
- RHSA-2002:202 third-party-advisory vendor-advisory
- RHSA-2003:048 third-party-advisory vendor-advisory
- 5581 patch third-party-advisory vdb-entry vendor-advisory