CVE-2014-8991

Опубликовано: 24 нояб. 2014

Источник: nvd

CVSS2: 2.1

EPSS Низкий

Описание

pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.

Ссылки

http://www.openwall.com/lists/oss-security/2014/11/19/17
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/11/20/6
Mailing List
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
Third Party Advisory
http://www.securityfocus.com/bid/71209
Third Party Advisory
VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847
Issue Tracking
Third Party Advisory
https://github.com/pypa/pip/pull/2122
Patch
Vendor Advisory
http://www.openwall.com/lists/oss-security/2014/11/19/17
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/11/20/6
Mailing List
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
Third Party Advisory
http://www.securityfocus.com/bid/71209
Third Party Advisory
VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847
Issue Tracking
Third Party Advisory
https://github.com/pypa/pip/pull/2122
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*

Версия от 1.3 (включая) до 1.5.6 (включая)

Конфигурация 2

cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*

EPSS

Процентиль: 22%

0.00072

Низкий

2.1 Low

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2014-8991

ubuntu

около 11 лет назад

pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.

CVE-2014-8991

redhat

около 12 лет назад

pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.

CVE-2014-8991

msrc

4 месяца назад

pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.

CVE-2014-8991

debian

около 11 лет назад

pip 1.3 through 1.5.6 allows local users to cause a denial of service ...

GHSA-53mr-44pp-crf4

CVSS3: 6.2

github

больше 3 лет назад

pip lack of randomness in build directory

EPSS

Процентиль: 22%

0.00072

Низкий

2.1 Low

CVSS2

Дефекты

NVD-CWE-noinfo