CVE-2014-1604: rply - Spoofing Cache Data
Summary
CVE-2014-1604: The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name. Affects rply across 2 version ranges.
< 0.7.1
< fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c
Fixed in fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c. How to fix ↓
Also tracked for
- python-rply · Debian:11
The same CVE-2014-1604 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rply is a Python package available on PyPI that provides a parser generator for creating parsers. It is used to generate efficient parsers for various programming languages. The package utilizes a parser cache functionality to improve performance by storing parsed data. However, prior to version 0.7.1, rply is vulnerable to a spoofing attack where local users can manipulate the cache data by creating a temporary file with a predictable name.
Vulnerability Detail
The vulnerability (CVE-2014-1604) in rply allows local users to spoof cache data by pre-creating a temporary file with a predictable name. This can lead to the manipulation of cached data, potentially resulting in the execution of arbitrary code or unauthorized access to sensitive information. The issue arises from the lack of proper validation and security measures in the parser cache functionality of rply.
How To Fix
Latest published version: 0.7.8 as of 22 Oct 2026
pip install --upgrade "rply==0.7.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c
This is the first release that contains the fix.
pip install --upgrade "rply==fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in rply allows local users to spoof cache data, potentially leading to the execution of arbitrary code or unauthorized access to sensitive information. It is crucial to update rply to version 0.7.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for rply →
FAQ
This vulnerability allows local users to manipulate cache data, potentially leading to the execution of arbitrary code or unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Pipfile.lock and Vulert will analyze it in real-time.
Yes, updating rply to version 0.7.1 or later will fix this vulnerability. It is recommended to upgrade the package as soon as possible.
There are no known public exploits available for this vulnerability at the moment. However, it is important to apply the fix to prevent any potential exploitation.
You can find more information about this vulnerability in the official advisory database of PyPA at https://github.com/pypa/advisory-database/blob/main/vulns/rply/PYSEC-2014-17.yaml
Related vulnerabilities
Recent vulnerabilities recorded for rply.
