230 matches found
CVE-2024-4030 tempfile.mkdtemp() may be readable and writeable by all users on Windows
On Windows a directory returned by tempfile.mkdtemp would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile...
Python 安全漏洞
Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in python that stems from Python's lack of support for Unix permissions on Windows...
PT-2024-7267
Name of the Vulnerable Software and Affected Versions: Python versions prior to 3.13 Description: The issue is related to the tempfile.mkdtemp function in Python, which on Windows, may not always set the correct permissions for the temporary directory, allowing other users to read and write to it...
GLSA-202405-01 : Python, PyPy3: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202405-01 Python, PyPy3: Multiple Vulnerabilities - An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the...
SUSE-SU-2024:0782-2 Security update for python311
This update for python311 fixes the following issues: - CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory bsc1219666. - CVE-2023-27043: Fixed incorrect e-mqil parsing bsc1210638. - CVE-2022-25236: Fixed an expat vulnerability by supporting expat = 2.4.4 bsc1212015...
openSUSE Security Advisory (SUSE-SU-2024:1162-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-6597
CVE-2023-6597 affects CPython’s tempfile.TemporaryDirectory behavior across multiple Python releases. The issue arises when cleanup dereferences symlinks during permissions-related error handling, potentially allowing a user running privileged programs to modify permissions of files referenced by...
CVE-2023-6597
An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged...
SUSE-SU-2024:0820-1 Security update for python310
This update for python310 fixes the following issues: - CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory bsc1219666...
SUSE-SU-2024:0782-1 Security update for python311
This update for python311 fixes the following issues: - CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory bsc1219666. - CVE-2023-27043: Fixed incorrect e-mqil parsing bsc1210638. - CVE-2022-25236: Fixed an expat vulnerability by supporting expat = 2.4.4 bsc1212015...
BIT-TENSORFLOW-2022-23563 Insecure temporary file in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. In multiple places, TensorFlow uses tempfile.mktemp to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in...
SUSE CVE-2023-6597
An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged...
PT-2023-8833 · Python +10 · Cpython +10
Name of the Vulnerable Software and Affected Versions: CPython versions 3.12.1 through 3.12.1 CPython versions 3.11.7 through 3.11.7 CPython versions 3.10.13 through 3.10.13 CPython versions 3.9.18 through 3.9.18 CPython versions 3.8.18 and prior Description: The issue is related to the...
GHSA-F2WX-XJFW-XJV6 topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all
Summary https://github.com/advisories/GHSA-mc8h-8q98-g5hr https://github.com/XAMPPRocky/removedirall/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead tempfile v0.4.26 ships with affected removedirall v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean carg...
topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all
Summary https://github.com/advisories/GHSA-mc8h-8q98-g5hr https://github.com/XAMPPRocky/removedirall/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead tempfile v0.4.26 ships with affected removedirall v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean carg...
PT-2023-33012 · Unknown +3 · Remove Dir All +3
Name of the Vulnerable Software and Affected Versions: tempfile versions prior to the version that updates remove dir all to a non-vulnerable version remove dir all version 0.5.3 Description: The issue concerns a problem with the remove dir all function. Updating tempfile is necessary due to its...
apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider
A flaw was found in Apache James's Mime4j TempFileStorageProvider class, where it may set improper permissions when utilizing temporary files. This flaw allows a locally authorized attacker to access information outside their intended permissions...
SUSE CVE-2009-5081
The 1 config.guess, 2 contrib/groffer/perl/groffer.pl, and 3 contrib/groffer/perl/roff2.pl scripts in GNU troff aka groff 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary fil...