CVE-2011-4944

Published: 27 August 2012

Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.

Notes

Author	Note
tyhicks	Code in Lib/distutils/command/register.py in 2.4 and 2.5

Priority

Status

Package	Release	Status
python2.4 Launchpad, Ubuntu, Debian	hardy	Released (2.4.5-1ubuntu4.4)
	lucid	Does not exist
	maverick	Does not exist
	natty	Does not exist
	oneiric	Does not exist
	precise	Does not exist
	quantal	Does not exist
	raring	Does not exist
	upstream	Needed
python2.5 Launchpad, Ubuntu, Debian	hardy	Released (2.5.2-2ubuntu6.2)
	lucid	Does not exist
	maverick	Does not exist
	natty	Does not exist
	oneiric	Does not exist
	precise	Does not exist
	quantal	Does not exist
	raring	Does not exist
	upstream	Needed
python2.6 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Released (2.6.5-1ubuntu6.1)
	maverick	Ignored (reached end-of-life)
	natty	Released (2.6.6-6ubuntu7.1)
	oneiric	Released (2.6.7-4ubuntu1.1)
	precise	Does not exist
	quantal	Does not exist
	raring	Does not exist
	upstream	Needed
	Patches: upstream: http://bugs.python.org/file23824/pypirc-secure.diff
python2.7 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	lucid	Does not exist
	maverick	Ignored (reached end-of-life)
	natty	Released (2.7.1-5ubuntu2.2)
	oneiric	Released (2.7.2-5ubuntu1.1)
	precise	Not vulnerable (2.7.3~rc2-2)
	quantal	Not vulnerable
	raring	Not vulnerable
	upstream	Pending (2.7.3~rc2-2)
	Patches: upstream: http://hg.python.org/cpython/rev/f833e7ec4de1/
python3.1 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Released (3.1.2-0ubuntu3.2)
	maverick	Ignored (reached end-of-life)
	natty	Released (3.1.3-1ubuntu1.2)
	oneiric	Does not exist
	precise	Does not exist
	quantal	Does not exist
	raring	Does not exist
	upstream	Needed
	Patches: upstream: http://bugs.python.org/file23824/pypirc-secure.diff
python3.2 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Does not exist
	maverick	Does not exist
	natty	Released (3.2-1ubuntu1.2)
	oneiric	Released (3.2.2-0ubuntu1.1)
	precise	Released (3.2.3-0ubuntu3.2)
	quantal	Released (3.2.3-6ubuntu3.1)
	raring	Does not exist
	upstream	Needed
	Patches: upstream: http://bugs.python.org/file23824/pypirc-secure.diff
python3.3 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Does not exist
	maverick	Does not exist
	natty	Does not exist
	oneiric	Does not exist
	precise	Does not exist
	quantal	Not vulnerable (3.3.0-1)
	raring	Not vulnerable (3.3.1-1ubuntu5)
	upstream	Needed
	Patches: upstream: http://bugs.python.org/file23.34/pypirc-secure.diff

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Security