CVE-2014-8991 - Vulnerability Details - OpenCVE

pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00125.

Key SSVC decision points have not yet been added.

Vendors	Products
Oracle	Solaris
Pypa	Pip

Configuration 1 [-]

cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2014-0044	pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
Github GHSA	GHSA-53mr-44pp-crf4	pip lack of randomness in build directory

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2014/11/19/17
http://www.openwall.com/lists/oss-security/2014/11/20/6
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.securityfocus.com/bid/71209
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847
https://github.com/pypa/pip/pull/2122
https://nvd.nist.gov/vuln/detail/CVE-2014-8991
https://www.cve.org/CVERecord?id=CVE-2014-8991

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2014-11-24T15:00:00

Updated: 2024-08-06T13:33:12.668Z

Reserved: 2014-11-19T00:00:00

Link: CVE-2014-8991

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-11-24T15:59:15.640

Modified: 2025-04-12T10:46:40.837

Link: CVE-2014-8991

Redhat

Severity : Low

Publid Date: 2013-10-09T00:00:00Z

Links: CVE-2014-8991 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-11-11T00:00:00", "descriptions": [{"lang": "en", "value": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-10-17T13:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[oss-security] 20141117 Requesting a CVE for pip - Local DoS with predictable temp directory names", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847"}, {"name": "71209", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/71209"}, {"name": "[oss-security] 20141120 Re: Requesting a CVE for pip - Local DoS with predictable temp directory names", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pypa/pip/pull/2122"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-8991", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20141117 Requesting a CVE for pip - Local DoS with predictable temp directory names", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17"}, {"name": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"}, {"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847", "refsource": "CONFIRM", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847"}, {"name": "71209", "refsource": "BID", "url": "http://www.securityfocus.com/bid/71209"}, {"name": "[oss-security] 20141120 Re: Requesting a CVE for pip - Local DoS with predictable temp directory names", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6"}, {"name": "https://github.com/pypa/pip/pull/2122", "refsource": "CONFIRM", "url": "https://github.com/pypa/pip/pull/2122"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T13:33:12.668Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20141117 Requesting a CVE for pip - Local DoS with predictable temp directory names", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847"}, {"name": "71209", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/71209"}, {"name": "[oss-security] 20141120 Re: Requesting a CVE for pip - Local DoS with predictable temp directory names", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/pypa/pip/pull/2122"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-8991", "datePublished": "2014-11-24T15:00:00", "dateReserved": "2014-11-19T00:00:00", "dateUpdated": "2024-08-06T13:33:12.668Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2B311CF-E147-4A9D-A90F-E5CC6B9A3AEE", "versionEndIncluding": "1.5.6", "versionStartIncluding": "1.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*", "matchCriteriaId": "0B1C288F-326B-497B-B26C-D26E01262DDB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user."}, {"lang": "es", "value": "pip 1.3 hasta 1.5.6 permite a usuarios locales causar una denegaci\u00f3n de servicio (prevenci\u00f3n de la instalaci\u00f3n de paquetes) mediante la creaci\u00f3n de un fichero /tmp/pip-build-* para otro usuario."}], "id": "CVE-2014-8991", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-11-24T15:59:15.640", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/71209"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/pypa/pip/pull/2122"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/71209"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/pypa/pip/pull/2122"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}