Unscored CVE-2023-43782 EUVD-2023-48159GHSA-353r-fqp4-g8f7

Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if it has been created…

Published Sep 22, 2023 · Updated Sep 24, 2024 · Assigned by mitre

Description

Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if it has been created by a local adversary before Cadence started. The adversary can then delete the file, disrupting Cadence.

References

https://bugzilla.suse.com/show_bug.cgi?id=1213983
https://github.com/falkTX/Cadence
[oss-security] 20231005 Cadence: Fixed /tmp path issues; no longer maintained by upstream (CVE-2023-43782, CVE-2023-43783) mailing-list