Description
Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | python3 +1 | 3.6.10-3.42.2 | SUSE-SU-2020:0114-1 |
| SLES 15 | python3 +1 | 3.6.10-3.42.2 | SUSE-SU-2020:0114-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python310 | 3.10.0rc1-4.2 | openSUSE-SU-2024:11283-1 |
| openSUSE Tumbleweed | python311 | 3.11.0b1-1.1 | openSUSE-SU-2024:12089-1 |
| openSUSE Tumbleweed | python312 | 3.12.0a7-1.1 | openSUSE-SU-2024:12910-1 |
| openSUSE Tumbleweed | python313 | 3.13.0~b3-1.1 | openSUSE-SU-2024:14109-1 |
| openSUSE Tumbleweed | python314 | 3.14.0~a1-1.1 | openSUSE-SU-2024:14434-1 |
| openSUSE Tumbleweed | python315 | 3.15.0~a1-1.1 | openSUSE-SU-2025:15713-1 |
| openSUSE Tumbleweed | python36 | 3.6.15-1.1 | openSUSE-SU-2024:11284-1 |
| openSUSE Tumbleweed | python38 | 3.8.12-1.2 | openSUSE-SU-2024:11285-1 |
| openSUSE Tumbleweed | python39 | 3.9.7-2.1 | openSUSE-SU-2024:11286-1 |
| openSUSE Leap 15.1 | python3 +1 | 3.6.10-lp151.6.7.1 | openSUSE-SU-2020:0086-1 |
Advisories 12
- openSUSE-SU-2025:15713-1 python315-3.15.0~a1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2024:11285-1 python38-3.8.12-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14434-1 python314-3.14.0~a1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0086-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11286-1 python39-3.9.7-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12910-1 python312-3.12.0a7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11283-1 python310-3.10.0rc1-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12089-1 python311-3.11.0b1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14109-1 python313-3.13.0~b3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0114-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11284-1 python36-3.6.15-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2520 Python: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 9, 2025
References
- [oss-security] 20140328 CVE request: os.makedirs(exist_ok=True) is not thread-safe in Python mailing-list
- openSUSE-SU-2014:0597 vendor-advisory
- GLSA-201503-10 vendor-advisory
- [oss-security] 20140330 Re: CVE request: os.makedirs(exist_ok=True) is not thread-safe in Python mailing-list
- http://bugs.python.org/issue21082
- [oss-security] 20140329 Re: [PSRT] CVE request: os.makedirs(exist_ok=True) is not thread-safe in Python mailing-list
- openSUSE-SU-2014:0596 vendor-advisory
- openSUSE-SU-2020:0086 vendor-advisory