CVE-2014-1838: Improper Link Resolution Before File Access in logilab-commons

May 14, 2022 (updated September 30, 2024)

The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-common before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.

References

bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051
github.com/advisories/GHSA-rr52-wg7f-8875
github.com/pypa/advisory-database/tree/main/vulns/logilab-common/PYSEC-2014-83.yaml
nvd.nist.gov/vuln/detail/CVE-2014-1838

Code Behaviors & Features

Detect and mitigate CVE-2014-1838 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →