PYSEC-2014-17

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/rply/PYSEC-2014-17.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2014-17

Aliases

Published

2014-01-28T00:55:00Z

Modified

2023-11-08T03:57:34.637338Z

Summary

[none]

Details

The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.

References

Affected packages

PyPI / rply

Package

Name: rply; View open source insights on deps.dev
Purl: pkg:pypi/rply

Affected ranges

Type: GIT
Repo: https://github.com/alex/rply
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.7.1

Affected versions

0.*

0.5

0.5.1

0.6.0

0.6.1

0.7.0

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/rply/PYSEC-2014-17.yaml"