CVE-2014-2667: Race Condition

Published Nov 16, 2014

Updated

Race condition in the getmaskedmode function in Lib/os.py in Python 3.2 through 3.5, when existok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Affected Software

17 affected components

Python Python=3.2.0

Python Python=3.2.1

Python Python=3.2.2

Python Python=3.2.3

Python Python=3.2.4

Python Python=3.2.5

Python Python=3.2.6

Python Python=3.3.0

Python Python=3.3.1

Python Python=3.3.2

Python Python=3.3.3

Python Python=3.3.4

Python Python=3.3.5

Python Python=3.3.6

Python Python=3.4.0

Python Python=3.4.1

Python Python=3.4.2

Event History

Nov 16, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-2667?

CVE-2014-2667 is categorized as a medium severity vulnerability due to the potential for local users to bypass file permissions.

How do I fix CVE-2014-2667?

To fix CVE-2014-2667, you should upgrade to a patched version of Python, ideally version 3.5 or later.

Which versions of Python are affected by CVE-2014-2667?

CVE-2014-2667 affects Python versions 3.2 through 3.4, including all versions in between, such as 3.2.0 to 3.4.2.

Can CVE-2014-2667 be exploited remotely?

No, CVE-2014-2667 can only be exploited locally by users with access to the system.

What specific issue does CVE-2014-2667 address?

CVE-2014-2667 addresses a race condition in the _get_masked_mode function that can allow users to bypass intended file permissions.