filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1,  StrictSoftFileLock  and  AsyncStrictSoftFileLock  on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…lelock/security/advisories/GHSA-6627-m3xw-93mp Diğer
• github.com/tox-dev/filelock/pull/839 Diğer
• github.com/…ommit/8cf51802158b9cf7e1fc560c2da30491a662cfde Diğer
• github.com/…ommit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03 Diğer
• github.com/tox-dev/filelock/releases/tag/4.2.1 Diğer

Kayıt geçmişi

1. 6 Kas 2026 00:54Yayımlandı

İlgili açıklar

• 5,8 CVE-2026-112938filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
• 2,5 CVE-2026-112907filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
• 3,3 CVE-2026-112913filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
• 5,3 CVE-2026-112910filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
• 3,3 CVE-2026-112941filelock SoftReadWriteLock, kilit ağacı değiştirilerek kilit kayıtlarının başka dizinlere yazılmasına izin veriyor
• 7,1 CVE-2026-112940filelock ReadWriteLock'ta SQLite üzerinden dosya üzerine yazma ve silme açığı