CVE-2014-1624 pyxdg Arbitrary File Overwrite via Race Condition
LowCVSS 3.3
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pyxdg(PyPI) | < 0.26 | 0.26 |
| pypi pyxdg(PyPI) | = 0.19 | No fix listed |
| pypi pyxdg(PyPI) | = 0.20 | No fix listed |
| pypi pyxdg(PyPI) | = 0.21 | No fix listed |
| pypi pyxdg(PyPI) | = 0.22 | No fix listed |
| pypi pyxdg(PyPI) | = 0.23 | No fix listed |
| pypi pyxdg(PyPI) | = 0.24 | No fix listed |
| pypi pyxdg(PyPI) | = 0.25 | No fix listed |
| pypi pyxdg(PyPI) | >= 0.25, < 0.26 | 0.26 |
| pypi pyxdg(PyPI) | <= 0.25 | No fix listed |
| debian/pyxdg(Debian:12) | < 0.25-4 | 0.25-4 |
| debian/pyxdg(Debian:13) | < 0.25-4 | 0.25-4 |
| debian/pyxdg(Debian:14) | < 0.25-4 | 0.25-4 |
| python pyxdg | = 0.25 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- pythonxdg-cve20141624-symlink(90618) vdb-entry
- github.com
- github.com product
- web.archive.org
- bugs.debian.org
- [oss-security] 20140121 Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp mailing-list
- [oss-security] 20140121 Re: Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp mailing-list
- 65042 vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-1624 vendor-advisory
- bugs.debian.org issue-tracking