Upstream information

CVE-2014-2667 at MITRE

Description

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

SUSE information

CVSS v2 Scores
  National Vulnerability Database
Base Score 3.32
Vector AV:L/AC:M/Au:N/C:P/I:P/A:N
Access Vector Local
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None
SUSE Bugzilla entry: 871152 [CLOSED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Desktop 12
  • libpython3_4m1_0 >= 3.4.1-2.38
  • python3-base >= 3.4.1-2.38
Patchnames:
SUSE Linux Enterprise Desktop 12 GA libpython3_4m1_0
SUSE Linux Enterprise Desktop 12 SP1
  • libpython3_4m1_0 >= 3.4.1-12.1
  • python3-base >= 3.4.1-12.1
Patchnames:
SUSE Linux Enterprise Desktop 12 SP1 GA libpython3_4m1_0
SUSE Linux Enterprise Desktop 12 SP2
  • libpython3_4m1_0 >= 3.4.1-12.1
  • python3-base >= 3.4.1-12.1
Patchnames:
SUSE Linux Enterprise Desktop 12 SP2 GA libpython3_4m1_0
SUSE Linux Enterprise Server 12
  • libpython3_4m1_0 >= 3.4.1-2.38
  • python3-base >= 3.4.1-2.38
Patchnames:
SUSE Linux Enterprise Server 12 GA libpython3_4m1_0
SUSE Linux Enterprise Server 12 SP1
  • libpython3_4m1_0 >= 3.4.1-12.1
  • python3-base >= 3.4.1-12.1
Patchnames:
SUSE Linux Enterprise Server 12 SP1 GA libpython3_4m1_0
SUSE Linux Enterprise Server 12 SP2
  • libpython3_4m1_0 >= 3.4.1-12.1
  • python3-base >= 3.4.1-12.1
Patchnames:
SUSE Linux Enterprise Server 12 SP2 GA libpython3_4m1_0
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
  • libpython3_4m1_0 >= 3.4.1-12.1
  • python3-base >= 3.4.1-12.1
Patchnames:
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 GA libpython3_4m1_0
SUSE Linux Enterprise Software Development Kit 12
  • python3-devel >= 3.4.1-2.38
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 GA python3-devel
SUSE Linux Enterprise Software Development Kit 12 SP1
  • python3-devel >= 3.4.1-12.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 SP1 GA python3-devel
SUSE Linux Enterprise Software Development Kit 12 SP2
  • python3-devel >= 3.4.1-12.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 SP2 GA python3-devel
openSUSE 13.1
  • libpython3_3m1_0 >= 3.3.5-5.8.1
  • libpython3_3m1_0-32bit >= 3.3.5-5.8.1
  • libpython3_3m1_0-debuginfo >= 3.3.5-5.8.1
  • libpython3_3m1_0-debuginfo-32bit >= 3.3.5-5.8.1
  • python3 >= 3.3.5-5.8.2
  • python3-32bit >= 3.3.5-5.8.2
  • python3-base >= 3.3.5-5.8.1
  • python3-base-32bit >= 3.3.5-5.8.1
  • python3-base-debuginfo >= 3.3.5-5.8.1
  • python3-base-debuginfo-32bit >= 3.3.5-5.8.1
  • python3-base-debugsource >= 3.3.5-5.8.1
  • python3-curses >= 3.3.5-5.8.2
  • python3-curses-debuginfo >= 3.3.5-5.8.2
  • python3-dbm >= 3.3.5-5.8.2
  • python3-dbm-debuginfo >= 3.3.5-5.8.2
  • python3-debuginfo >= 3.3.5-5.8.2
  • python3-debuginfo-32bit >= 3.3.5-5.8.2
  • python3-debugsource >= 3.3.5-5.8.2
  • python3-devel >= 3.3.5-5.8.1
  • python3-devel-debuginfo >= 3.3.5-5.8.1
  • python3-doc >= 3.3.5-5.8.1
  • python3-doc-pdf >= 3.3.5-5.8.1
  • python3-idle >= 3.3.5-5.8.1
  • python3-testsuite >= 3.3.5-5.8.1
  • python3-testsuite-debuginfo >= 3.3.5-5.8.1
  • python3-tk >= 3.3.5-5.8.2
  • python3-tk-debuginfo >= 3.3.5-5.8.2
  • python3-tools >= 3.3.5-5.8.1
Patchnames:
openSUSE-2014-334
openSUSE 13.2
  • libpython3_4m1_0 >= 3.4.1-4.2.1
  • python3-base >= 3.4.1-4.2.1
Patchnames:
openSUSE 13.2 GA libpython3_4m1_0
openSUSE Leap 42.1
  • libpython3_4m1_0 >= 3.4.1-6.2
  • python3-base >= 3.4.1-6.2
Patchnames:
openSUSE Leap 42.1 GA libpython3_4m1_0
openSUSE Leap 42.2
  • libpython3_4m1_0 >= 3.4.5-9.1
  • python3-base >= 3.4.5-9.1
  • python3-devel >= 3.4.5-9.1
Patchnames:
openSUSE Leap 42.2 GA libpython3_4m1_0
openSUSE Tumbleweed
  • libpython3_5m1_0 >= 3.5.1-3.6
  • libpython3_5m1_0-32bit >= 3.5.1-3.6
  • python3-base >= 3.5.1-3.6
  • python3-base-32bit >= 3.5.1-3.6
  • python3-devel >= 3.5.1-3.6
  • python3-idle >= 3.5.1-3.6
  • python3-testsuite >= 3.5.1-3.6
  • python3-tools >= 3.5.1-3.6
Patchnames:
openSUSE Tumbleweed GA libpython3_5m1_0