tox-dev filelock: race condition issue

The tox-dev filelock version 3.22.0 up to version 4.2.1 has a race condition vulnerability. This vulnerability arises from race conditions in SoftFileLock, where the active marker may be removed after reading an outdated marker, allowing both holders of the lock to obtain the lock at the same tim...

tox-dev filelock: Processing logic error vulnerability

The tox-dev filelock version 4.1.0 to 4.2.1 contained a processing logic vulnerability. This vulnerability stemmed from the SoftFileLock component reusing outdated observation results when at least two lock user processes were waiting. An attacker could set and delete their own markers, and use...

tox-dev filelock backend link vulnerability

The tox-dev filelock version 3.20.4 to 4.0.9 contains security vulnerabilities. These vulnerabilities stem from the way ReadWriteLock and AsyncReadWriteLock handle lock paths, which allow them to pass the final symbolic link to SQLite without being rejected. This may lead to other local users...

tox-dev filelock: Permissions, permission grants, and access control issues

The tox-dev filelock version 3.30.0 to 4.2.1 had vulnerabilities related to permission handling and access control. These vulnerabilities stemmed from the use of StrictSoftFileLock version 3.30.0 and later, as well as SoftReadWriteLock version 4.0.0 and later. These versions may use a protocol...

tox-dev filelock: Input validation error vulnerability

The tox-dev filelock version 4.2.1 and earlier contain a vulnerability related to input validation errors. This vulnerability arises when UnixFileLock allows another local user to have the permission to rename files, or when files are hard-linked to lock paths using a relaxed hard-link strategy. ...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 prior to version 4.2.1 has a race condition vulnerability. This vulnerability arises due to race conditions during cleanup by the ReadWriteLock. It allows other local users with rename permissions in non-sticky parent directories to observe activity nam...

tox-dev filelock backend link vulnerability

In versions of tox-dev FileLock from 4.0.0 to 4.2.1, there was a post-processing link vulnerability. This vulnerability stemmed from SoftReadWriteLock’s mechanism for refreshing holder records by name. Local users with permission to rename lock directories could replace the records with named...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 had a race condition vulnerability. This vulnerability stemmed from SoftFileLock’s ability to restore files by their name after removing an outdated marker. This allowed local users with rename privileges in non-sticky lock directories to replace symbol...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 had a race condition issue. This issue stemmed from the SoftReadWriteLock and AsyncSoftReadWriteLock classes’ caching mechanism for checking the .rw lock tree successfully, and then re-reshaping its name during subsequent recording operations. This coul...

tox-dev-filelock Resource Management Error Vulnerability

The tox-dev filelock version 3.20.4 to 4.2.1 contained a resource management vulnerability. This vulnerability stemmed from the ReadWriteLock being used to open custom SQLite lock databases without limiting the workload on schemas and queries. As a result, local users who had access to the databa...

tox-dev filelock: Input validation error vulnerability

The tox-dev filelock version 3.22.0 to 4.2.1 prior to version 4.2.1 has a vulnerability related to input validation errors. This vulnerability stems from a forged process identifier in the SoftFileLock trust mark, which can be modified by an attacker. This could allow authorized actors to act as ...

tox-dev filelock backend link vulnerability

The tox-dev filelock version 3.32.6 up to version 4.2.1 has a post-processing link vulnerability. This vulnerability arises from SoftFileLock’s handling of symbolic links when checking the writeability of nodes without owner write permissions. It may allow local users to infer whether the selecte...

tox-dev filelock: race condition issue

The tox-dev filelock version 3.20.4 up to version 4.2.1 has a race condition vulnerability. This vulnerability stems from the ReadWriteLock mechanism, which allows SQLite to reopen databases and associated files by their names. Attackers with renaming privileges on POSIX systems can replace these...

EulerOS 2.0 SP13 : python-filelock (EulerOS-SA-2026-4093)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

EulerOS 2.0 SP11 : python-filelock (EulerOS-SA-2026-4366)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

EulerOS 2.0 SP11 : python-filelock (EulerOS-SA-2026-4276)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

EulerOS 2.0 SP13 : python-filelock (EulerOS-SA-2026-4184)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2020-5258 DESCRIPTION: In affected versions of dojo NPM package, the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053278)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053278 advisory. In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected When fcntlsetlk races with clos...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001463)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001463 advisory. In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posixlockinode Light Hsieh reported a KASAN UAF warning...