Executive brief
RPLY is a Python library used by developers to build parsers for programming languages or data formats. A vulnerability in how it handles temporary files allows a local attacker on a shared system to interfere with the library's cache. This could lead to incorrect program behavior or data manipulation for other users on the same machine.
Technical details
The parser cache functionality in RPLY's parsergenerator.py uses predictable filenames (rply-*.json) within the system's global temporary directory (e.g., /tmp). Because these filenames are deterministic and the directory is world-writable, a local attacker can pre-create these files with malicious content. When another user runs an application using RPLY, the library may load the attacker-controlled cache file instead of generating its own, leading to cache spoofing and potential logic manipulation. This was addressed in version 0.7.1 by implementing per-user cache handling and more secure file permission checks.
Affected products
- Alex Gaynor RPLY < 0.7.1
Timeline
- 2014-01-14: disclosed: Initial report on Debian bug tracker
- 2014-01-17: patched: Fix committed to GitHub repository
- 2014-01-17: advisory: CVE-2014-1604 assigned
- 2014-01-28: advisory: NVD publication date