Link Following in rply · CVE-2014-1938 · GitHub Advisory Database · GitHub

Link Following in rply

Moderate severity GitHub Reviewed Published Mar 11, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

rply (pip)

Affected versions

< 0.7.4

Patched versions

0.7.4

Description

python-rply before 0.7.4 insecurely creates temporary files.

References

Reviewed Mar 11, 2020

Published to the GitHub Advisory Database Mar 11, 2020

Last updated Jan 9, 2023

Severity

Moderate

5.5

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H