high7.7
CVE-2024-34528
WordOps has TOCTOU race condition
Impact
WordOps through 3.20.0 has a `wo/cli/plugins/stack_pref.py` TOCTOU race condition because the `conf_path` `os.open` does not use a mode parameter during file creation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | wordops | < 3.21.0 | 3.21.0 |
Affected products
| Product | Affected versions |
|---|---|
| WordOps | through 3.20.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/WordOps/WordOps/blob/ecf20192c7853925e2cb3f8c8378cd0d86ca0d62/wo/cli/plugins/stack_pref.py#L77
- https://github.com/WordOps/WordOps/issues/611
- https://github.com/advisories/GHSA-23qq-p4gq-gc2g
- https://nvd.nist.gov/vuln/detail/CVE-2024-34528
- https://github.com/WordOps/WordOps/commit/31353f0fef14ad8bc1f61c028971bd30b9e1909b
- https://github.com/pypa/advisory-database/tree/main/vulns/wordops/PYSEC-2024-175.yaml