GHSA-23qq-p4gq-gc2g

WordOps has TOCTOU race condition

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-34528

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	wordops	< 3.21.0	3.21.0

Details

As written in the advisory (Markdown source, shown as plain text).

WordOps through 3.20.0 has a `wo/cli/plugins/stack_pref.py` TOCTOU race condition because the `conf_path` `os.open` does not use a mode parameter during file creation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-34528 advisory
https://github.com/WordOps/WordOps/issues/611 web
https://github.com/WordOps/WordOps/commit/31353f0fef14ad8bc1f61c028971bd30b9e1909b web
https://github.com/WordOps/WordOps package
https://github.com/WordOps/WordOps/blob/ecf20192c7853925e2cb3f8c8378cd0d86ca0d62/wo/cli/plugins/stack_pref.py#L77 web
https://github.com/pypa/advisory-database/tree/main/vulns/wordops/PYSEC-2024-175.yaml web