GitHub Advisoryadvisory · PyPI

GHSA-23qq-p4gq-gc2g WordOps has TOCTOU race condition

MEDIUM Published 2024-05-06 Modified 2025-01-21 Official page ↗

Aliases: CVE-2024-34528
Ecosystem: PyPI
Packages: wordops
Severity: Moderate
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses: CWE-362, CWE-367
Reviewed: 2024-05-06

Affected packages

• PyPI wordops: < 3.21.0 → fixed in 3.21.0

Description

WordOps through 3.20.0 has a `wo/cli/plugins/stack_pref.py` TOCTOU race condition because the `conf_path` `os.open` does not use a mode parameter during file creation.

Alias · CVE (1)

CVE-2024-34528 WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter… vulnerability

Weakness · CWE (2)

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2024-34528 advisory
https://github.com/WordOps/WordOps/issues/611 web
https://github.com/WordOps/WordOps/commit/31353f0fef14ad8bc1f61c028971bd30b9e1909b web
https://github.com/WordOps/WordOps package
https://github.com/WordOps/WordOps/blob/ecf20192c7853925e2cb3f8c8378cd0d86ca0d62/wo/cli/plugins/stack_pref.py#L77 web
https://github.com/pypa/advisory-database/tree/main/vulns/wordops/PYSEC-2024-175.yaml web