CVE-2014-1938: Insecure Creation of Temporary Files in python-rply
Summary
CVE-2014-1938: python-rply before 0.7.4 insecurely creates temporary files. Affects rply versions < 0.7.4. Fixed in 0.7.4. How to fix ↓
Also tracked for
- python-rply · Debian:11
The same CVE-2014-1938 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-rply is a Python library that provides a pure Python parser generator. It is commonly used for parsing and tokenizing input data in various applications. The library allows developers to define grammars and generate parsers based on those grammars. However, versions before 0.7.4 of python-rply insecurely create temporary files, which can lead to potential security vulnerabilities.
Vulnerability Detail
The vulnerability (CVE-2014-1938) in python-rply arises from the insecure creation of temporary files. When creating temporary files, the library does not follow secure practices, which can allow an attacker to manipulate or overwrite these files. This vulnerability can be exploited to execute arbitrary code, modify sensitive data, or cause a denial of service (DoS) attack. It is important to note that this vulnerability was fixed in version 0.7.4 of python-rply.
How To Fix
Latest published version: 0.7.8 as of 22 Oct 2026
pip install --upgrade "rply==0.7.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.4
This is the first release that contains the fix.
pip install --upgrade "rply==0.7.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability (CVE-2014-1938) in python-rply arises from the insecure creation of temporary files. It is important to update python-rply to version 0.7.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for rply →
FAQ
python-rply is a Python library used for parsing and tokenizing input data.
The vulnerability allows an attacker to manipulate or overwrite temporary files, potentially leading to arbitrary code execution, data modification, or denial of service.
You can fix this vulnerability by updating python-rply to version 0.7.4 or later.
No specific workaround has been mentioned for this vulnerability.
You can find more information about this vulnerability in the advisory database of the Python Packaging Authority (PyPA).
Related vulnerabilities
Recent vulnerabilities recorded for rply.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
