GitHub Advisoryadvisory · PyPI

GHSA-vxf2-7rc3-pxmx Cheetah Path Search Order Hijacking

HIGH Published 2022-05-01 Modified 2023-09-18 Official page ↗
Aliases
CVE-2005-1632
Ecosystem
PyPI
Packages
cheetah
Severity
High
Weaknesses
CWE-427
Reviewed
2023-09-18

Affected packages

• PyPI cheetah: >= 0.9.15, <= 0.9.16 (no fix yet)

Description

Cheetah 0.9.15 and 0.9.16 searches the `/tmp` directory for modules before using the paths in the `PYTHONPATH` variable, which allows local users to execute arbitrary code via a malicious module in `/tmp/`.

Related

Alias · CVE (1)

  • CVE-2005-1632 Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local… vulnerability

Weakness · CWE (1)

  • CWE-427 Uncontrolled Search Path Element weakness

References