CVE-2005-1632 Cheetah Path Search Order Hijacking
HighCVSS 7.2
EPSS 0.44%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tavis rudd cheetah | = 0.9.15 | No fix listed |
| tavis rudd cheetah | = 0.9.16 | No fix listed |
| pypi cheetah(PyPI) | >= 0.9.15, <= 0.9.16 | No fix listed |
| debian/cheetah(Debian:12) | < 0.9.16-1 | 0.9.16-1 |
| debian/cheetah(Debian:13) | < 0.9.16-1 | 0.9.16-1 |
| debian/cheetah(Debian:14) | < 0.9.16-1 | 0.9.16-1 |
References
- 15386 third-party-advisory vendor-advisory
- sourceforge.net patch
- 16622 vdb-entry
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- web.archive.org
- github.com vendor-advisory
- pypi.org product
- Debian Security Tracker CVE-2005-1632 vendor-advisory