GHSA-rr52-wg7f-8875HighCVSS 5.6

Improper Link Resolution Before File Access in logilab-commons

Published
May 14, 2022
Last Modified
September 30, 2024

🔗 CVE IDs covered (1)

CVE-2014-1838 →

📋 Description

The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-common before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.

🎯 Affected products1

  • pip/logilab-common:< 0.61.0

🔗 References (7)