GHSA-xrr4-74mc-rpjc

Source

https://github.com/advisories/GHSA-xrr4-74mc-rpjc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-xrr4-74mc-rpjc/GHSA-xrr4-74mc-rpjc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xrr4-74mc-rpjc

Aliases

Published

2018-08-21T17:01:29Z

Modified

2024-10-15T16:42:55Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Pyro mishandles pid files in temporary directory locations and opening the pid file as root

Details

pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.

Database specific

{
    "cwe_ids":  [
        "CWE-59"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T22:04:21Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

PyPI / pyro

Package

Name: pyro; View open source insights on deps.dev
Purl: pkg:pypi/pyro

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.15

Affected versions

3.*

3.9.1

3.10

3.11

3.12

3.13

3.14

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-xrr4-74mc-rpjc/GHSA-xrr4-74mc-rpjc.json"