CVE-2011-2185 Fabric vulnerable to symlink attack on tmp files
MediumCVSS 4.4
EPSS 0.33%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a /tmp/fab.*.tar file or (2) certain other files in the top level of /tmp/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi fabric(PyPI) | < 1.1.0 | 1.1.0 |
| pypi fabric(PyPI) | = 0.0.1 | No fix listed |
| pypi fabric(PyPI) | = 0.0.2 | No fix listed |
| pypi fabric(PyPI) | = 0.0.3 | No fix listed |
| pypi fabric(PyPI) | = 0.0.4 | No fix listed |
| pypi fabric(PyPI) | = 0.0.5 | No fix listed |
| pypi fabric(PyPI) | = 0.0.6 | No fix listed |
| pypi fabric(PyPI) | = 0.0.7 | No fix listed |
| pypi fabric(PyPI) | = 0.0.8 | No fix listed |
| pypi fabric(PyPI) | = 0.0.9 | No fix listed |
| pypi fabric(PyPI) | = 0.1.0 | No fix listed |
| pypi fabric(PyPI) | = 0.1.1 | No fix listed |
| pypi fabric(PyPI) | = 0.9.0 | No fix listed |
| pypi fabric(PyPI) | = 0.9.1 | No fix listed |
| pypi fabric(PyPI) | = 0.9.2 | No fix listed |
| pypi fabric(PyPI) | = 0.9.3 | No fix listed |
| pypi fabric(PyPI) | = 0.9.4 | No fix listed |
| pypi fabric(PyPI) | = 0.9.5 | No fix listed |
| pypi fabric(PyPI) | = 0.9.6 | No fix listed |
| pypi fabric(PyPI) | = 0.9.7 | No fix listed |
| pypi fabric(PyPI) | = 1.0.0 | No fix listed |
| pypi fabric(PyPI) | = 1.0.1 | No fix listed |
| pypi fabric(PyPI) | = 1.0.2 | No fix listed |
| pypi fabric(PyPI) | = 1.0.3 | No fix listed |
| pypi fabric(PyPI) | = 1.0.4 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi fabric(PyPI) | = 1.0.5 | No fix listed |
| debian/fabric(Debian:12) | < 1.1.2-1 | 1.1.2-1 |
| debian/fabric(Debian:13) | < 1.1.2-1 | 1.1.2-1 |
| debian/fabric(Debian:14) | < 1.1.2-1 | 1.1.2-1 |
| fabfile fabric | <= 1.0.2 | No fix listed |
| fabfile fabric | = 0.9 | No fix listed |
| fabfile fabric | = 0.9.1 | No fix listed |
| fabfile fabric | = 0.9.2 | No fix listed |
| fabfile fabric | = 0.9.3 | No fix listed |
| fabfile fabric | = 0.9.4 | No fix listed |
| fabfile fabric | = 0.9.5 | No fix listed |
| fabfile fabric | = 0.9.6 | No fix listed |
| fabfile fabric | = 0.9.7 | No fix listed |
| fabfile fabric | = 1.0.0 | No fix listed |
| fabfile fabric | = 1.0.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugzilla.redhat.com
- github.com product
- bugs.debian.org
- code.fabfile.org patch
- FEDORA-2011-8964 vendor-advisory
- [oss-security] 20110603 CVE Request -- fabric -- Use of insecure temporary file by uploading templates and projects to remote hosts mailing-list
- [oss-security] 20110606 Re: CVE Request -- fabric -- Use of insecure temporary file by uploading templates and projects to remote hosts mailing-list
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2011-2185 vendor-advisory
- bugs.debian.org issue-tracking