CVE-2012-0878: Vulnerability in Paste Script
Summary
CVE-2012-0878: Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application... Affects paste versions < 1.7.5.1. Fixed in 1.7.5.1. How to fix ↓
Also tracked for
- pastescript · PyPI
- pastescript · PyPI
- pastescript · Debian:11
The same CVE-2012-0878 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Paste Script is a Python package available on PyPI that provides a set of command-line tools for working with web applications. It is commonly used in conjunction with web frameworks like Pylons and TurboGears. The package allows developers to create and manage web application templates, handle HTTP requests, and perform various other web-related tasks. However, versions 1.7.5 and earlier of Paste Script suffer from a vulnerability that affects the proper setting of group memberships when executed with root privileges. This flaw can be exploited by remote attackers through a web application that utilizes the local filesystem, potentially allowing them to bypass intended file-access restrictions.
Vulnerability Detail
The vulnerability in Paste Script arises from its failure to correctly set group memberships during execution with root privileges. This oversight can be leveraged by attackers who have access to a web application that interacts with the local filesystem. By exploiting this vulnerability, an attacker may be able to circumvent intended file-access restrictions and gain unauthorized access to sensitive files or directories. The impact of this vulnerability depends on the specific permissions and file-access controls in place on the affected system. It is important to note that this vulnerability has been assigned the CVE identifier CVE-2012-0878.
How To Fix
Minimum fixed version
1.7.5.1
This is the first release that contains the fix.
pip install --upgrade "paste==1.7.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can consider implementing additional access controls and permissions on sensitive files and directories to mitigate the risk of unauthorized access. It is important to note that such workarounds may vary depending on the specific web application and system configuration.
Conclusion
In conclusion, the Paste Script package versions 1.7.5 and earlier suffer from a vulnerability that can be exploited by remote attackers through a web application. This flaw allows attackers to bypass file-access restrictions and potentially gain unauthorized access to sensitive files or directories. Users are advised to update their installations to version 1.7.5.1 or later to mitigate the risk associated with this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for paste →
FAQ
Paste Script is a Python package that provides command-line tools for working with web applications.
Versions 1.7.5 and earlier of Paste Script are affected by this vulnerability.
This vulnerability can be exploited by remote attackers through a web application that interacts with the local filesystem.
The impact of this vulnerability depends on the specific permissions and file-access controls in place on the affected system. It may allow attackers to bypass intended file-access restrictions and gain unauthorized access to sensitive files or directories.
Yes, this vulnerability has been assigned the CVE identifier CVE-2012-0878.
Related vulnerabilities
Recent vulnerabilities recorded for paste.
