Date: Fri, 28 Mar 2014 16:23:01 -0600 From: "Vincent Danen" <vdanen@...hat.com> To: "OSS Security List" <oss-security@...ts.openwall.com> Cc: security@...hon.org Subject: CVE request: os.makedirs(exist_ok=True) is not thread-safe in Python Cc'ing security@...hon.org so that they are aware of the CVE assignment (so please keep them in the cc). Just copying and pasting from the Red Hat bug: It was reported  that a patch added to Python 3.2  caused a race condition where a file created could be created with world read/write permissions instead of the permissions dictated by the original umask of the process. This could allow a local attacker that could win the race to view and edit files created by a program using this call. Note that prior versions of Python, including 2.x, do not include the vulnerable _get_masked_mode() function that is used by os.makedirs() when exist_ok is set to True.  http://bugs.python.org/issue21082  http://bugs.python.org/issue9299 Our bug is here: https://bugzilla.redhat.com/show_bug.cgi?id=1082177 Could a CVE be assigned to this issue please? Thank you. -- Vincent Danen / Red Hat Security Response Team Download attachment "signature.asc" of type "application/pgp-signature" (711 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.