—

PYSEC-2013-33

Quick fix

PYSEC-2013-33 — suds-py3: upgrade to the fixed version with the command below.

pip install --upgrade 'suds-py3>=1.4.4.1'

Details

cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/suds-py3

Introduced in: 0Fixed in: 1.4.4.1

Fixpip install --upgrade 'suds-py3>=1.4.4.1'

References

http://lists.opensuse.org/opensuse-updates/2013-07/msg00062.html[WEB]
http://www.openwall.com/lists/oss-security/2013/06/27/8[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=978696[REPORT]
http://www.ubuntu.com/usn/USN-2008-1[ADVISORY]
https://github.com/advisories/GHSA-vpqp-hx68-p2wx[ADVISORY]