Fluid Attacks Database

Description

Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	python2.7	>=0 <2.7.3~rc2-2	2.7.3~rc2-2
rpm rhel5	python	<0:2.4.3-46.el5_8.2	0:2.4.3-46.el5_8.2
rpm rhel6	python	<0:2.6.6-29.el6_2.2	0:2.6.6-29.el6_2.2

Aliases

1. CVE-2011-49442. NVD-2011-49443. OSV-DEBIAN-2011-49444. OSV-2011-49445. SECURITY-TRACKER-CVE-2011-4944

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.