CVE-2011-2765 Insecure temporary file handling
HighCVSS 7.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pyro(PyPI) | < 3.15 | 3.15 |
| pypi pyro(PyPI) | = 3.10 | No fix listed |
| pypi pyro(PyPI) | = 3.11 | No fix listed |
| pypi pyro(PyPI) | = 3.12 | No fix listed |
| pypi pyro(PyPI) | = 3.13 | No fix listed |
| pypi pyro(PyPI) | = 3.14 | No fix listed |
| pypi pyro(PyPI) | = 3.9.1 | No fix listed |
| debian/pyro(Debian:10) | < 1:3.14-1 | 1:3.14-1 |
| pyro project pyro | < 3.15 | 3.15 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- bugs.debian.org exploit issue-tracking third-party-advisory
- github.com product
- github.com
- pythonhosted.org vendor-advisory
- github.com vendor-advisory