Description
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 rpm rhel7 | | - |
rpm rhel9 | | - |
rpm rhel8 | | - |
 debian 11 | | =7.3.10+dfsg-1 || =7.3.10~rc3+dfsg-1 || =7.3.10~rc3+dfsg-2 || =7.3.11+dfsg-1 || =7.3.11+dfsg-2 || =7.3.12+dfsg-1 || =7.3.12~rc1+dfsg-1 || =7.3.12~rc2+dfsg-1 || =7.3.13+dfsg-1 || =7.3.14+dfsg-1 || =7.3.15+dfsg-1 || =7.3.16+dfsg-1 || =7.3.16+dfsg-2 || =7.3.17+dfsg-1 || =7.3.17+dfsg-2 || =7.3.17+dfsg-3 || =7.3.18+dfsg-1 || =7.3.18+dfsg-2 || =7.3.19+dfsg-1 || =7.3.19+dfsg-2 || =7.3.20+dfsg-1 || =7.3.20+dfsg-2 || =7.3.20+dfsg-3 || =7.3.20+dfsg-4 || =7.3.21+dfsg-1 || =7.3.21+dfsg-2 || =7.3.21+dfsg-3 || =7.3.21+dfsg-4 || =7.3.5+dfsg-2 || =7.3.5+dfsg-2+deb11u1 || =7.3.5+dfsg-2+deb11u2 || =7.3.5+dfsg-2+deb11u3 || =7.3.5+dfsg-2+deb11u4 || =7.3.5+dfsg-2+deb11u5 || =7.3.6+dfsg-1 || =7.3.6~rc2+dfsg-1 || =7.3.6~rc2+dfsg-2 || =7.3.7+dfsg-1 || =7.3.7+dfsg-2 || =7.3.7+dfsg-3 || =7.3.7+dfsg-4 || =7.3.7+dfsg-5 || =7.3.8+dfsg-1 || =7.3.8+dfsg-2 || =7.3.8~rc1+dfsg-1 || =7.3.8~rc1+dfsg-2 || =7.3.9+dfsg-1 || =7.3.9+dfsg-2 || =7.3.9+dfsg-3 || =7.3.9+dfsg-4 || =7.3.9+dfsg-5 |
debian 12 | | =7.3.11+dfsg-2 || =7.3.11+dfsg-2+deb12u1 || =7.3.11+dfsg-2+deb12u2 || =7.3.11+dfsg-2+deb12u3 || =7.3.12+dfsg-1 || =7.3.12~rc1+dfsg-1 || =7.3.12~rc2+dfsg-1 || =7.3.13+dfsg-1 || =7.3.14+dfsg-1 || =7.3.15+dfsg-1 || =7.3.16+dfsg-1 || =7.3.16+dfsg-2 || =7.3.17+dfsg-1 || =7.3.17+dfsg-2 || =7.3.17+dfsg-3 || =7.3.18+dfsg-1 || =7.3.18+dfsg-2 || =7.3.19+dfsg-1 || =7.3.19+dfsg-2 || =7.3.20+dfsg-1 || =7.3.20+dfsg-2 || =7.3.20+dfsg-3 || =7.3.20+dfsg-4 || =7.3.21+dfsg-1 || =7.3.21+dfsg-2 || =7.3.21+dfsg-3 || =7.3.21+dfsg-4 |
debian 13 | | =7.3.19+dfsg-2 || =7.3.20+dfsg-1 || =7.3.20+dfsg-2 || =7.3.20+dfsg-3 || =7.3.20+dfsg-4 || =7.3.21+dfsg-1 || =7.3.21+dfsg-2 || =7.3.21+dfsg-3 || =7.3.21+dfsg-4 |
debian 14 | | =7.3.19+dfsg-2 || =7.3.20+dfsg-1 || =7.3.20+dfsg-2 || =7.3.20+dfsg-3 || =7.3.20+dfsg-4 || =7.3.21+dfsg-1 || =7.3.21+dfsg-2 || =7.3.21+dfsg-3 || =7.3.21+dfsg-4 |
debian 11 | | =2.7.18-10 || =2.7.18-11 || =2.7.18-12 || =2.7.18-13 || =2.7.18-13.1 || =2.7.18-13.1~exp1 || =2.7.18-13.2 || =2.7.18-8 || =2.7.18-8+deb11u1 || =2.7.18-9 |
rpm rhel9 | | - |
rpm rhel9 | | - |
