CVE-2014-2667

Published: 16 November 2014

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Notes

The upstream patch uses umask(0022) instead of umask(0) -- which
seems as bad as the original behaviour. We should see if there is an updated
patch when we prepare our packages that replaces the bad code.

introduced by the fix for http://bugs.python.org/issue9299
upstream commited a better fix than the proposed one in the bug
but it now changes behavour

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2667
• http://seclists.org/oss-sec/2014/q1/687
• NVD
• Launchpad
• Debian

Bugs

• http://bugs.python.org/issue21082