CVE-2014-1839: Insecure Permissions in logilab-commons
Summary
CVE-2014-1839: Creation of Temporary File With Insecure Permissions in logilab-commons. Affects logilab-common versions < 0.61.0. Fixed in 0.61.0. How to fix ↓
Also tracked for
- logilab-common · Debian:11
The same CVE-2014-1839 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
logilab-common is a Python package available on PyPI that provides various utilities and functions for common programming tasks. It is widely used in Python projects for its convenience and functionality. However, versions of logilab-common before 0.61.0 are vulnerable to a security issue that involves the creation of temporary files with insecure permissions.
Vulnerability Detail
The vulnerability in logilab-common arises from the use of the Execute class in the shellutils module, which utilizes the tempfile.mktemp function. This function is susceptible to a local privilege escalation attack, as it creates temporary files with predictable names and insecure permissions. An attacker with local access to the system could exploit this vulnerability to gain unauthorized access or perform arbitrary actions on the affected system.
How To Fix
Minimum fixed version
0.61.0
This is the first release that contains the fix.
pip install --upgrade "logilab-common==0.61.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating logilab-common is not immediately feasible, a possible workaround is to manually modify the permissions of the temporary files created by the Execute class. By setting strict permissions (e.g., read and write only for the owner), the risk of unauthorized access or exploitation can be mitigated. However, this workaround is not recommended as it may introduce additional complexities and potential security risks.
Conclusion
The vulnerability in logilab-common versions prior to 0.61.0 allows local users to exploit insecure permissions on temporary files. To mitigate this risk, it is crucial to update logilab-common to version 0.61.0 or later. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for logilab-common →
FAQ
logilab-common is a Python package that provides utilities and functions for common programming tasks. It is widely used in Python projects.
The vulnerability allows local users to exploit insecure permissions on temporary files, potentially leading to unauthorized access or arbitrary actions on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Pipfile.lock and it will provide real-time alerts for open-source vulnerabilities.
Yes, updating logilab-common to version 0.61.0 or later will fix this vulnerability. It is recommended to update as soon as possible.
While manually modifying the permissions of temporary files can mitigate the risk, it is not recommended as it may introduce additional complexities and potential security risks. It is best to update logilab-common to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for logilab-common.
