GitHub Advisoryadvisory · PyPI

GHSA-xwg2-qc6c-7c3q Fabric vulnerable to symlink attack on tmp files

MEDIUM Published 2022-05-17 Modified 2024-01-19 Official page ↗
Aliases
CVE-2011-2185
Ecosystem
PyPI
Packages
fabric
Severity
Moderate
Weaknesses
CWE-59
Reviewed
2024-01-19

Affected packages

• PyPI fabric: < 1.1.0 → fixed in 1.1.0

Description

Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a `/tmp/fab.*.tar` file or (2) certain other files in the top level of `/tmp/`.

Related

Alias · CVE (1)

  • CVE-2011-2185 Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a /tmp/fab.*.tar file or (2) certain other… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References