PT-2014-4860 · Python+2 · Python+2
Vincent Danen
·
Publicado
2014-05-14
·
Atualizado
2025-11-07
·
CVE-2014-2667
CVSS v2.0
3.3
Baixa
| Vetor | AV:L/AC:M/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Python versions 3.2 through 3.5
Description
A race condition exists in the
get masked mode function in Lib/os.py, which can be exploited by local users to bypass intended file permissions. This issue arises when exist ok is set to true and multiple threads are used, allowing a separate application vulnerability to be leveraged before the umask has been set to the expected value.Recommendations
For Python versions 3.2 through 3.5, consider applying configuration changes to avoid using the
exist ok parameter with multiple threads to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Python
Suse