CVE-2011-4944 Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a usernam...
LowCVSS 1.9
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python2.7(Debian:11) | < 2.7.3~rc2-2 | 2.7.3~rc2-2 |
| python | = 2.6.1 | No fix listed |
| python | = 2.6.2 | No fix listed |
| python | = 2.6.3 | No fix listed |
| python | = 2.6.4 | No fix listed |
| python | = 2.6.5 | No fix listed |
| python | = 2.6.6 | No fix listed |
| python | = 2.6.7 | No fix listed |
| python | = 2.6.8 | No fix listed |
| python | = 2.6.2150 | No fix listed |
| python | = 2.6.6150 | No fix listed |
| python | = 2.7.1 | No fix listed |
| python | = 2.7.1-rc1 | No fix listed |
| python | = 2.7.2-rc1 | No fix listed |
| python | = 2.7.3 | No fix listed |
| python | = 2.7.1150 | No fix listed |
| python | = 2.7.2150 | No fix listed |
| python | = 3.0 | No fix listed |
| python | = 3.0.1 | No fix listed |
| python | = 3.1 | No fix listed |
| python | = 3.1.1 | No fix listed |
| python | = 3.1.2 | No fix listed |
| python | = 3.1.3 | No fix listed |
| python | = 3.1.4 | No fix listed |
| python | = 3.1.5 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| python | = 3.1.2150 | No fix listed |
| python | = 3.2 | No fix listed |
| python | = 3.2-alpha | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- bugs.debian.org
- bugs.python.org
- bugs.python.org
- APPLE-SA-2013-10-22-3 vendor-advisory
- openSUSE-SU-2020:0086 vendor-advisory
- 50858 third-party-advisory
- 51024 third-party-advisory
- 51040 third-party-advisory
- 51087 third-party-advisory
- 51089 third-party-advisory
- [oss-security] 20120327 Re: CVE request: distutils creates ~/.pypirc insecurely mailing-list
- [oss-security] 20120327 CVE request: distutils creates ~/.pypirc insecurely mailing-list
- [oss-security] 20120327 Re: CVE request: distutils creates ~/.pypirc insecurely mailing-list
- USN-1592-1 vendor-advisory
- USN-1596-1 vendor-advisory
- USN-1613-1 vendor-advisory
- USN-1613-2 vendor-advisory
- USN-1615-1 vendor-advisory
- USN-1616-1 vendor-advisory
- bugzilla.redhat.com