Arbitrary File Overwrite Affecting pyro package, versions [,3.15)
Snyk CVSS
Attack Complexity
Low
Integrity
High
Threat Intelligence
EPSS
0.21% (59th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PYRO-72279
- published 1 Sep 2018
- disclosed 1 Sep 2011
- credit Unknown
Introduced: 1 Sep 2011
CVE-2011-2765 Open this link in a new tabHow to fix?
Upgrade pyro to version 3.15 or higher.
Overview
pyro is a Distributed Object Technology system written entirely in Python, that is designed to be very easy to use.
Affected versions of this package are vulnerable to Arbitrary File Overwrite. It handled pid files in temporary directory locations and was opening the pid file as root. An attacker could use this flaw to overwrite arbitrary files via symlinks.