VAITP Dataset

← Back to the dataset

CVE-2014-1938

Python-rply < 0.7.4 insecurely creates temporary files

  • CVSS 5.5
  • CWE-59 Improper Link Resolution Before File Access ('Link Following')
  • Information Leakage
  • Local

python-rply before 0.7.4 insecurely creates temporary files.

CVE
CVE-2014-1938
CWE
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CVSS base score
5.5
Published
2019-11-21
OWASP
A08 Software and Data Integrity Failures
Orthogonal defect classification
Function
Code defect classification
Incorrect Functionality
Category
Information Leakage
Subcategory
Insecure Handling of Sensitive Data
Accessibility scope
Local
Impact
Unauthorized Access
Fixed by upgrading
Yes

Solution

Update python-rply to version 0.7.4 or higher.

Vulnerable code sample

import os
import tempfile

def create_temp_file():
    temp_file_path = '/tmp/temp_file'
    
    with open(temp_file_path, 'w') as temp_file:
        temp_file.write('This is an temporary file.')
    
    return temp_file_path

temp_file_path = create_temp_file()
print(f'Temporary file created at: {temp_file_path}')

Patched code sample

import tempfile
import os

def create_temp_file():
    with tempfile.NamedTemporaryFile(delete=False) as temp_file:
        temp_file.write(b'This is a temporary file.')
        temp_file_path = temp_file.name
    
    os.chmod(temp_file_path, 0o600)
    return temp_file_path

temp_file_path = create_temp_file()
print(f'Temporary file created at: {temp_file_path}')

Cite this entry

@misc{vaitp:cve20141938,
  title        = {{Python-rply < 0.7.4 insecurely creates temporary files}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2014-1938},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2014-1938/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::