Lucene search
Ubuntu.comUB:CVE-2014-2667HistoryNov 16, 2014 - 12:00 a.m.
CVE-2014-2667
2014-11-1600:00:00
ubuntu.com
ubuntu.com
11
3.3 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:P/A:N
0.0004 Low
EPSS
Percentile
5.3%
Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2
through 3.5, when exist_ok is set to true and multiple threads are used,
might allow local users to bypass intended file permissions by leveraging a
separate application vulnerability before the umask has been set to the
expected value.
Bugs
Notes
| Author | Note |
|---|---|
| seth-arnold | The upstream patch uses umask(0022) instead of umask(0) – which seems as bad as the original behaviour. We should see if there is an updated patch when we prepare our packages that replaces the bad code. |
| mdeslaur | introduced by the fix for http://bugs.python.org/issue9299 upstream commited a better fix than the proposed one in the bug but it now changes behavour |
Related
openvas
openvas
Python 3.2.x < 3.2.6, 3.3.x < 3.3.6, 3.4.x < 3.4.1 os.makedirs() not thread-safe (bpo-21082) - Linux
2021-11-01 00:00:00
Mageia: Security Advisory (MGASA-2014-0216)
2022-01-28 00:00:00
Fedora Update for python3 FEDORA-2014-16393
2014-12-12 00:00:00
prion
prion
Race condition
2014-11-16 01:59:00
nessus
nessus
openSUSE Security Update : python3 (openSUSE-SU-2014:0596-1)
2014-06-13 00:00:00
Fedora 19 : python3-3.3.2-11.fc19 (2014-16479)
2015-01-06 00:00:00
Fedora 20 : python3-3.3.2-19.fc20 (2014-16393)
2014-12-15 00:00:00
cve
cve
CVE-2014-2667
2014-11-16 01:59:00
mageia
mageia
Updated python3 packages fix security vulnerability
2014-05-15 02:04:31
debiancve
debiancve
CVE-2014-2667
2014-11-16 01:59:00
fedora
fedora
[SECURITY] Fedora 20 Update: python3-3.3.2-19.fc20
2014-12-12 04:23:13
[SECURITY] Fedora 19 Update: python3-3.3.2-11.fc19
2015-01-06 06:16:20
gentoo
gentoo
Python: Multiple vulnerabilities
2015-03-18 00:00:00
suse
suse
Security update for python3 (important)
2020-01-21 00:00:00
3.3 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:P/A:N
0.0004 Low
EPSS
Percentile
5.3%
Related for UB:CVE-2014-2667