Untriaged
python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp
python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
References
- https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093 x_refsource_MISC
- https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093 x_refsource_MISC x_transferred
- https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093 x_refsource_MISC
- https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093 x_refsource_MISC x_transferred
- https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093 x_refsource_MISC
- https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093 x_refsource_MISC x_transferred
Affected products
python-dbusmock
- <0.15.1
Matching in nixpkgs
pkgs.python312Packages.python-dbusmock
Mock D-Bus objects for tests
pkgs.python313Packages.python-dbusmock
Mock D-Bus objects for tests
pkgs.python314Packages.python-dbusmock
Mock D-Bus objects for tests
Package maintainers
-
@callahad Dan Callahan <dan.callahan@gmail.com>