Lucene search

[email protected]CVE-2011-4944

HistoryAug 27, 2012 - 11:55 p.m.

CVE-2011-4944

2012-08-2723:55:01

CWE-264

[email protected]

web.nvd.nist.gov

180

cve

python

.pypirc

credentials

security

race condition

nvd

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

AI Score

8.1

Confidence

High

EPSS

Percentile

10.1%

JSON

Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.

Affected configurations

NVD

Node

pythonpythonMatch2.6.1

pythonpythonMatch2.6.2

pythonpythonMatch2.6.3

pythonpythonMatch2.6.4

pythonpythonMatch2.6.5

pythonpythonMatch2.6.6

pythonpythonMatch2.6.7

pythonpythonMatch2.6.8

pythonpythonMatch2.6.2150

pythonpythonMatch2.6.6150

pythonpythonMatch2.7.1

pythonpythonMatch2.7.1rc1

pythonpythonMatch2.7.2rc1

pythonpythonMatch2.7.3

pythonpythonMatch2.7.1150

pythonpythonMatch2.7.1150x64

pythonpythonMatch2.7.2150

pythonpythonMatch3.0

pythonpythonMatch3.0.1

pythonpythonMatch3.1

pythonpythonMatch3.1.1

pythonpythonMatch3.1.2

pythonpythonMatch3.1.3

pythonpythonMatch3.1.4

pythonpythonMatch3.1.5

pythonpythonMatch3.1.2150x64

pythonpythonMatch3.2

pythonpythonMatch3.2alpha

VendorProductVersionCPE
pythonpython3.1cpe:/a:python:python:3.1:::
pythonpython3.2cpe:/a:python:python:3.2:::
pythonpython2.6.6cpe:/a:python:python:2.6.6:::
pythonpython3.0.1cpe:/a:python:python:3.0.1:::
pythonpython2.7.1cpe:/a:python:python:2.7.1:::
pythonpython2.6.8cpe:/a:python:python:2.6.8:::
pythonpython2.7.2cpe:/a:python:python:2.7.2:rc1::
pythonpython3.0cpe:/a:python:python:3.0:::
pythonpython2.6.2cpe:/a:python:python:2.6.2:::
pythonpython2.7.1150cpe:/a:python:python:2.7.1150:::

Vendor	Product	Version	CPE
python	python	3.1	cpe:/a:python:python:3.1:::
python	python	3.2	cpe:/a:python:python:3.2:::
python	python	2.6.6	cpe:/a:python:python:2.6.6:::
python	python	3.0.1	cpe:/a:python:python:3.0.1:::
python	python	2.7.1	cpe:/a:python:python:2.7.1:::
python	python	2.6.8	cpe:/a:python:python:2.6.8:::
python	python	2.7.2	cpe:/a:python:python:2.7.2:rc1::
python	python	3.0	cpe:/a:python:python:3.0:::
python	python	2.6.2	cpe:/a:python:python:2.6.2:::
python	python	2.7.1150	cpe:/a:python:python:2.7.1150:::