PT-2012-2011 · Python+3 · Python+3
Vincent Danen
·
Publicado
2012-06-18
·
Atualizado
2025-11-07
·
CVE-2011-4944
CVSS v2.0
1.9
Baixa
| Vetor | AV:L/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Python versions 2.6 through 3.2
Description
The issue introduces a race condition where local users can obtain a username and password by reading the ~/.pypirc file, which is created with world-readable permissions before the permissions are changed after data has been written.
Recommendations
For Python versions 2.6 through 3.2, consider changing the permissions of the ~/.pypirc file immediately after creation to prevent unauthorized access. As a temporary workaround, restrict access to the ~/.pypirc file until a more permanent solution is applied.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Python
Red Hat
Suse