GHSA-vpqp-hx68-p2wx

Improper Link Resolution Before File Access in Suds

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-2217

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	suds	< 1.0.0	1.0.0
PyPI	suds-py3	< 1.4.4.1	1.4.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-2217 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=978696 web
https://github.com/advisories/GHSA-vpqp-hx68-p2wx advisory
https://github.com/pypa/advisory-database/tree/main/vulns/suds-py3/PYSEC-2013-33.yaml web
https://github.com/pypa/advisory-database/tree/main/vulns/suds/PYSEC-2013-32.yaml web
http://lists.opensuse.org/opensuse-updates/2013-07/msg00062.html web
http://www.openwall.com/lists/oss-security/2013/06/27/8 web
http://www.ubuntu.com/usn/USN-2008-1 web