—

PYSEC-2013-32

Quick fix

PYSEC-2013-32 — suds: upgrade to the fixed version with the command below.

pip install --upgrade 'suds>=0.7.0'

Details

cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/suds

Introduced in: 0Fixed in: 0.7.0

Fixpip install --upgrade 'suds>=0.7.0'

References

http://lists.opensuse.org/opensuse-updates/2013-07/msg00062.html[WEB]
http://www.openwall.com/lists/oss-security/2013/06/27/8[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=978696[REPORT]
http://www.ubuntu.com/usn/USN-2008-1[ADVISORY]
https://github.com/advisories/GHSA-vpqp-hx68-p2wx[ADVISORY]