CVE-2012-0878 Paste Script has improper group memberships permissions
MediumCVSS 5.1
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pastescript(PyPI) | < 2.0.1 | 2.0.1 |
| pypi pastescript(PyPI) | = 0.3 | No fix listed |
| pypi pastescript(PyPI) | = 0.3.1 | No fix listed |
| pypi pastescript(PyPI) | = 0.4 | No fix listed |
| pypi pastescript(PyPI) | = 0.4.1 | No fix listed |
| pypi pastescript(PyPI) | = 0.4.2 | No fix listed |
| pypi pastescript(PyPI) | = 0.5 | No fix listed |
| pypi pastescript(PyPI) | = 0.5.1 | No fix listed |
| pypi pastescript(PyPI) | = 0.9 | No fix listed |
| pypi pastescript(PyPI) | = 0.9.6 | No fix listed |
| pypi pastescript(PyPI) | = 0.9.7 | No fix listed |
| pypi pastescript(PyPI) | = 0.9.8 | No fix listed |
| pypi pastescript(PyPI) | = 1.0 | No fix listed |
| pypi pastescript(PyPI) | = 1.1 | No fix listed |
| pypi pastescript(PyPI) | = 1.3 | No fix listed |
| pypi pastescript(PyPI) | = 1.3.1 | No fix listed |
| pypi pastescript(PyPI) | = 1.3.2 | No fix listed |
| pypi pastescript(PyPI) | = 1.3.3 | No fix listed |
| pypi pastescript(PyPI) | = 1.3.4 | No fix listed |
| pypi pastescript(PyPI) | = 1.3.5 | No fix listed |
| pypi pastescript(PyPI) | = 1.3.6 | No fix listed |
| pypi pastescript(PyPI) | = 1.6 | No fix listed |
| pypi pastescript(PyPI) | = 1.6.1 | No fix listed |
| pypi pastescript(PyPI) | = 1.6.1.1 | No fix listed |
| pypi pastescript(PyPI) | = 1.6.2 | No fix listed |
Show 47 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pastescript(PyPI) | = 1.6.3 | No fix listed |
| pypi pastescript(PyPI) | = 1.7 | No fix listed |
| pypi pastescript(PyPI) | = 1.7.2 | No fix listed |
| pypi pastescript(PyPI) | = 1.7.3 | No fix listed |
| pypi pastescript(PyPI) | = 1.7.4 | No fix listed |
| pypi pastescript(PyPI) | = 1.7.4.1 | No fix listed |
| pypi pastescript(PyPI) | = 1.7.4.2 | No fix listed |
| pypi pastescript(PyPI) | = 1.7.5 | No fix listed |
| pypi pastescript(PyPI) | = 2.0 | No fix listed |
| pypi paste(PyPI) | < 1.7.5.1 | 1.7.5.1 |
| pypi paste(PyPI) | = 0.3 | No fix listed |
| pypi paste(PyPI) | = 0.4 | No fix listed |
| pypi paste(PyPI) | = 0.4.1 | No fix listed |
| pypi paste(PyPI) | = 0.5 | No fix listed |
| pypi paste(PyPI) | = 0.9 | No fix listed |
| pypi paste(PyPI) | = 0.9.1 | No fix listed |
| pypi paste(PyPI) | = 0.9.2 | No fix listed |
| pypi paste(PyPI) | = 0.9.3 | No fix listed |
| pypi paste(PyPI) | = 0.9.5 | No fix listed |
| pypi paste(PyPI) | = 0.9.6 | No fix listed |
| pypi paste(PyPI) | = 0.9.7 | No fix listed |
| pypi paste(PyPI) | = 0.9.8 | No fix listed |
| pypi paste(PyPI) | = 0.9.8.1 | No fix listed |
| pypi paste(PyPI) | = 1.0 | No fix listed |
| pypi paste(PyPI) | = 1.0.1 | No fix listed |
| pypi paste(PyPI) | = 1.1 | No fix listed |
| pypi paste(PyPI) | = 1.1.1 | No fix listed |
| pypi paste(PyPI) | = 1.2 | No fix listed |
| pypi paste(PyPI) | = 1.2.1 | No fix listed |
| pypi paste(PyPI) | = 1.3 | No fix listed |
| pypi paste(PyPI) | = 1.4 | No fix listed |
| pypi paste(PyPI) | = 1.4.1 | No fix listed |
| pypi paste(PyPI) | = 1.4.2 | No fix listed |
| pypi paste(PyPI) | = 1.5 | No fix listed |
| pypi paste(PyPI) | = 1.5.1 | No fix listed |
| pypi paste(PyPI) | = 1.6 | No fix listed |
| pypi paste(PyPI) | = 1.7 | No fix listed |
| pypi paste(PyPI) | = 1.7.1 | No fix listed |
| pypi paste(PyPI) | = 1.7.2 | No fix listed |
| pypi paste(PyPI) | = 1.7.3 | No fix listed |
| pypi paste(PyPI) | = 1.7.3.1 | No fix listed |
| pypi paste(PyPI) | = 1.7.4 | No fix listed |
| pypi paste(PyPI) | = 1.7.5 | No fix listed |
| debian/pastescript(Debian:12) | < 1.7.5-2 | 1.7.5-2 |
| debian/pastescript(Debian:13) | < 1.7.5-2 | 1.7.5-2 |
| debian/pastescript(Debian:14) | < 1.7.5-2 | 1.7.5-2 |
| pythonpaste paste | <= 1.7.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bitbucket.org patch
- bitbucket.org patch
- bugzilla.redhat.com issue-tracking
- github.com product
- github.com
- web.archive.org
- web.archive.org
- groups.google.com
- RHSA-2012:1206 vendor-advisory
- [oss-security] 20120223 CVE Request -- python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root mailing-list patch
- [oss-security] 20120223 Re: CVE Request -- python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root mailing-list
- 48812 third-party-advisory vendor-advisory
- 50410 third-party-advisory vendor-advisory
- github.com vendor-advisory
- pypi.org product
- Debian Security Tracker CVE-2012-0878 vendor-advisory
- bugs.debian.org issue-tracking