GitHub Advisoryadvisory · PyPI

GHSA-3jhc-wjqf-5f2c Virtualenv Allows Symlink Attack on /tmp/

MEDIUM Published 2022-05-17 Modified 2024-11-18 Official page ↗
Aliases
CVE-2011-4617
Ecosystem
PyPI
Packages
virtualenv
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-59
Reviewed
2024-01-19

Affected packages

• PyPI virtualenv: < 1.5 → fixed in 1.5

Description

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Related

Alias · CVE (1)

  • CVE-2011-4617 virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/. vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References