GoogleOSV:GHSA-53MR-44PP-CRF4pip lack of randomness in build directory
6.4 Medium
AI Score
Confidence
High
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
24.3%
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
References
www.openwall.com/lists/oss-security/2014/11/19/17
www.openwall.com/lists/oss-security/2014/11/20/6
www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
www.securityfocus.com/bid/71209
bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847
github.com/pypa/pip
github.com/pypa/pip/commit/043fe9f5700315d97f83609c1f59deece8f1b901
github.com/pypa/pip/pull/2122
nvd.nist.gov/vuln/detail/CVE-2014-8991
Related
6.4 Medium
AI Score
Confidence
High
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
24.3%