MGASA-2026-0592: Updated python-pytest package fixes a security vulnerability
On UNIX, pytest uses a predictable naming scheme under /tmp with a UID check for added security. The UID check however will follow symlinks, and is vulnerable to TOCTOU. This leaves pytest vulnerable to several well-known vulnerabilities on multi-user systems. The risk ultimately depends on how pytest is used, but denial of service is trivial and code execution is possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/python-pytestto a version that resolves this vulnerability.Fixed in 9.0.3-1.mga10
Event History
Frequently Asked Questions
Which environments are most exposed to this issue?
Multi-user UNIX systems are the primary concern because pytest creates predictably named files under /tmp. The practical risk depends on how pytest is used in that environment.
What does an attacker need to exploit it?
An attacker needs the ability to manipulate filesystem entries in /tmp, such as by using symlinks, during pytest's check-and-use window. The vulnerable UID check follows symlinks, enabling a time-of-check to time-of-use race.
What impact is possible?
Denial of service is described as trivial. Code execution is also possible, depending on how pytest is used.