GitHub Advisoryadvisory · PyPI

GHSA-vqf9-v3hc-wr54 keycloak-httpd-client-install symlink attack vulnerability

MEDIUM Published 2022-05-14 Modified 2023-10-24 Official page ↗
Aliases
CVE-2017-15111
Ecosystem
PyPI
Packages
keycloak-httpd-client-install
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-59
Reviewed
2023-07-26

Affected packages

• PyPI keycloak-httpd-client-install: < 0.8 → fixed in 0.8

Description

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.

Related

Alias · CVE (1)

  • CVE-2017-15111 keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References