PT-2022-16162 · Backblaze · B2-Sdk-Python

Janschejbal + 1 · Published 2022-02-23 · Updated 2022-03-07 · CVE-2022-23651

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions b2-sdk-python versions 1.14.0 and below

Description The b2-sdk-python library contains a key disclosure vulnerability that can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. This vulnerability affects users of the SqliteAccountInfo format, while users of the InMemoryAccountInfo format are safe. The SqliteAccountInfo saves API keys and bucket name-to-id mapping in a local database file, which is initially world-readable and later altered to be private to the user. If the directory containing the file is readable by a local attacker, they can exploit the brief period between file creation and permission modification to read the sensitive information.

Recommendations For b2-sdk-python versions 1.14.0 and below, upgrade to b2-sdk-python 1.14.1 or later. If a local user might have opened a handle using this race condition, remove the affected database files and regenerate all application keys.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2022-23651

GHSA-P867-FXFR-PH2W

PYSEC-2022-33

Affected Products

B2-Sdk-Python

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23651.json · Exploit
• https://github.com/Backblaze/b2-sdk-python/commit/62476638986e5b6d7459aca5ef8ce220760226e0 · Patch
• https://osv.dev/vulnerability/PYSEC-2022-33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23651 · Security Note
• https://osv.dev/vulnerability/GHSA-p867-fxfr-ph2w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23651 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/b2sdk/PYSEC-2022-33.yaml · Note
• https://github.com/Backblaze/b2-sdk-python/security/advisories/GHSA-p867-fxfr-ph2w · Note
• https://github.com/Backblaze/b2-sdk-python · Note
• https://pypi.org/project/b2sdk · Note
• https://t.me/cvenotify/27253 · Telegram Post
• https://t.me/cibsecurity/37973 · Telegram Post
• https://t.me/cvenotify/27833 · Telegram Post