—

PYSEC-2018-99

Quick fix

PYSEC-2018-99 — pyro: upgrade to the fixed version with the command below.

pip install --upgrade 'pyro>=554e095a62c4412c91f981e72fd34a936ac2bf1e'

Details

pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/pyro

Introduced in: 0Fixed in: 554e095a62c4412c91f981e72fd34a936ac2bf1e

Fixpip install --upgrade 'pyro>=554e095a62c4412c91f981e72fd34a936ac2bf1e'

References

https://pythonhosted.org/Pyro/12-changes.html[WEB]
https://github.com/irmen/Pyro3/commit/554e095a62c4412c91f981e72fd34a936ac2bf1e[FIX]
https://bugs.debian.org/631912[WEB]
https://github.com/advisories/GHSA-xrr4-74mc-rpjc[ADVISORY]