Cheetah: Untrusted module search path

Cheetah: Untrusted module search path Cheetah contains a vulnerability in the module importing code that can allow a local user to gain escalated privileges. Cheetah 2005-05-19 2006-05-17 92926 local 0.9.17_rc1 0.9.17_rc1

Cheetah is a Python powered template engine and code generator.

Brian Bird discovered that Cheetah searches for modules in the world-writable /tmp directory.

A malicious local user could place a module containing arbitrary code in /tmp, which when imported would run with escalated privileges.

There are no known workarounds at this time.

All Cheetah users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-python/cheetah-0.9.17_rc1"

Secunia Advisory SA15386 jaervosz r2d2 koon