CVE-2011-4944

Published: 27 August 2012

Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.

Priority

Status

Package	Release	Status
python2.4 Launchpad, Ubuntu, Debian	Upstream	Needed






python2.5 Launchpad, Ubuntu, Debian	Upstream	Needed






python2.6 Launchpad, Ubuntu, Debian	Upstream	Needed






	Patches: Upstream: http://bugs.python.org/file23824/pypirc-secure.diff
python2.7 Launchpad, Ubuntu, Debian	Upstream	Pending (2.7.3~rc2-2)






	Patches: Upstream: http://hg.python.org/cpython/rev/f833e7ec4de1/
python3.1 Launchpad, Ubuntu, Debian	Upstream	Needed






	Patches: Upstream: http://bugs.python.org/file23824/pypirc-secure.diff
python3.2 Launchpad, Ubuntu, Debian	Upstream	Needed






	Patches: Upstream: http://bugs.python.org/file23824/pypirc-secure.diff
python3.3 Launchpad, Ubuntu, Debian	Upstream	Needed






	Patches: Upstream: http://bugs.python.org/file23.34/pypirc-secure.diff

Notes

Author	Note
tyhicks	Code in Lib/distutils/command/register.py in 2.4 and 2.5

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM