REDHAT-BUG-2459798: Medium severity pypi/python-dotenv vulnerability
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey() and unsetkey() in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
python-dotenvto a version that resolves this vulnerability.Fixed in 1.2.2 - Compensating control
As a workaround for versions prior to 1.2.2, manually apply the patch that prevents set_key() and unset_key() from following symbolic links when rewriting .env files during cross-device rename fallback.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2459798?
The severity of REDHAT-BUG-2459798 is medium, rated at 4.
How do I fix REDHAT-BUG-2459798?
To fix REDHAT-BUG-2459798, upgrade python-dotenv to version 1.2.2 or later.
What does REDHAT-BUG-2459798 affect?
REDHAT-BUG-2459798 affects python-dotenv prior to version 1.2.2.
What kind of attack can exploit REDHAT-BUG-2459798?
A local attacker can exploit REDHAT-BUG-2459798 to overwrite arbitrary files via a crafted symlink.
What functionality is compromised in REDHAT-BUG-2459798?
The `set_key()` and `unset_key()` functions in python-dotenv improperly handle symbolic links when modifying .env files.