CVE-2014-1604: RPLY Predictable Tmpfile Names Allows Cache Spoofing
Summary
CVE-2014-1604: RPLY Predictable Tmpfile Names Allows Cache Spoofing. Affects rply versions < 0.7.1. Fixed in 0.7.1. How to fix ↓
Also tracked for
- python-rply · Debian:11
The same CVE-2014-1604 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
RPLY (aka python-rply) is a Python library that provides a pure Python parser generator. It is commonly used for parsing and tokenizing input data in various applications. The parser cache functionality in RPLY allows for caching of parsed data, improving performance by avoiding redundant parsing. However, prior to version 0.7.1, RPLY is vulnerable to cache spoofing due to the predictable naming of temporary files. This vulnerability can be exploited by local users to manipulate cache data by creating a temporary file with a predictable name.
Vulnerability Detail
The vulnerability in RPLY arises from the use of predictable temporary file names in the parser cache functionality. By pre-creating a temporary file with a known name, an attacker can spoof cache data and potentially manipulate the behavior of the application that relies on RPLY. This can lead to various security issues, such as incorrect parsing or tokenization of input data, which may result in data corruption, information disclosure, or even remote code execution.
How To Fix
Latest published version: 0.7.8 as of 22 Oct 2026
pip install --upgrade "rply==0.7.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.1
This is the first release that contains the fix.
pip install --upgrade "rply==0.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually modify the code of the RPLY library to introduce randomization in the naming of temporary files. This can be achieved by modifying the 'parsergenerator.py' file and replacing the code responsible for generating temporary file names with a randomization mechanism. However, it is strongly recommended to apply the official fix by upgrading to RPLY version 0.7.1 or later, as manual modifications may introduce other issues or be overwritten during future updates.
Conclusion
In conclusion, the RPLY library prior to version 0.7.1 is vulnerable to cache spoofing due to the use of predictable temporary file names. This can be exploited by local users to manipulate cache data and potentially compromise the security and integrity of applications relying on RPLY. It is highly recommended to upgrade to RPLY version 0.7.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for rply →
FAQ
RPLY is a Python library that provides a pure Python parser generator. It is commonly used for parsing and tokenizing input data in various applications.
This vulnerability allows local users to manipulate cache data in RPLY, potentially leading to incorrect parsing or tokenization of input data. This can result in data corruption, information disclosure, or even remote code execution.
To fix this vulnerability, it is recommended to upgrade to RPLY version 0.7.1 or later. This version includes a fix that introduces randomization in the naming of temporary files, making it much harder for attackers to predict and manipulate cache data.
As a temporary workaround, users can manually modify the code of the RPLY library to introduce randomization in the naming of temporary files. However, it is strongly recommended to apply the official fix by upgrading to RPLY version 0.7.1 or later.
You can find more information about this vulnerability in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9gcf-pq99-rjw3/GHSA-9gcf-pq99-rjw3.json
Related vulnerabilities
Recent vulnerabilities recorded for rply.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
