PT-2012-2011 · Python+3 · Python+3
Vincent Danen
·
Published
2012-06-18
·
Updated
2025-11-07
·
CVE-2011-4944
CVSS v2.0
1.9
Low
| Vector | AV:L/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Python versions 2.6 through 3.2
Description
The issue introduces a race condition where local users can obtain a username and password by reading the ~/.pypirc file, which is created with world-readable permissions before the permissions are changed after data has been written.
Recommendations
For Python versions 2.6 through 3.2, consider changing the permissions of the ~/.pypirc file immediately after creation to prevent unauthorized access. As a temporary workaround, restrict access to the ~/.pypirc file until a more permanent solution is applied.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Python
Red Hat
Suse