CVE-2013-2217

Published: 23 September 2013

cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.

Priority

Status

Package	Release	Status
suds Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Released (0.4.1-2ubuntu1.1)
	quantal	Released (0.4.1-5ubuntu0.12.10.1)
	raring	Released (0.4.1-5ubuntu0.13.04.1)
	saucy	Not vulnerable (0.4.1-9)
	upstream	Released (0.4.1-8)

References

http://www.openwall.com/lists/oss-security/2013/06/27/5
https://ubuntu.com/security/notices/USN-2008-1
https://www.cve.org/CVERecord?id=CVE-2013-2217
NVD
Launchpad
Debian

Bugs

https://bugzilla.redhat.com/show_bug.cgi?id=978696
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=714340
https://bugs.launchpad.net/ubuntu/+source/suds/+bug/1227650

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›