GHSA-rr52-wg7f-8875

Source

https://github.com/advisories/GHSA-rr52-wg7f-8875

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rr52-wg7f-8875/GHSA-rr52-wg7f-8875.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rr52-wg7f-8875

Aliases

Published

2022-05-14T02:09:22Z

Modified

2024-09-30T17:01:03Z

Severity

5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Improper Link Resolution Before File Access in logilab-commons

Details

The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-common before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.

Database specific

{
    "cwe_ids": [
        "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-07T22:48:36Z",
    "nvd_published_at": "2014-03-11T19:37:00Z",
    "severity": "HIGH"
}

References

Affected packages

PyPI / logilab-common

Package

Name: logilab-common; View open source insights on deps.dev
Purl: pkg:pypi/logilab-common

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.61.0

Affected versions

0.*

0.28.1

0.38.0

0.38.1

0.39.0

0.43.0

0.44.0

0.46.0

0.46.1

0.47.0

0.48.1

0.49.0

0.50.0

0.50.1

0.50.2

0.50.3

0.51.0

0.51.1

0.52.0

0.52.1

0.53.0

0.54.0

0.55.0

0.55.2

0.56.0

0.56.1

0.56.2

0.57.0

0.57.1

0.58.1

0.58.3

0.59.0

0.59.1

0.60.0

0.60.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rr52-wg7f-8875/GHSA-rr52-wg7f-8875.json"