Description
Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cheetah | 0.9.16-1 | — |
| Debian 13 | cheetah | 0.9.16-1 | — |
| Debian 12 | cheetah | 0.9.16-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cheetah | >= 0.9.15, <= 0.9.16 | — | GHSA-vxf2-7rc3-pxmx |
References
- 15386 third-party-advisory
- http://sourceforge.net/mailarchive/forum.php?thread_id=7070332&forum_id=1542
- 16622 vdb-entry