{"id":"GHSA-23qq-p4gq-gc2g","summary":"WordOps has TOCTOU race condition","details":"WordOps through 3.20.0 has a `wo/cli/plugins/stack_pref.py` TOCTOU race condition because the `conf_path` `os.open` does not use a mode parameter during file creation.","aliases":["CVE-2024-34528","PYSEC-2024-175"],"modified":"2025-01-21T18:46:50.966383Z","published":"2024-05-06T00:30:52Z","database_specific":{"cwe_ids":["CWE-362","CWE-367"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-05-06T14:35:39Z","nvd_published_at":"2024-05-06T00:15:10Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34528"},{"type":"WEB","url":"https://github.com/WordOps/WordOps/issues/611"},{"type":"WEB","url":"https://github.com/WordOps/WordOps/commit/31353f0fef14ad8bc1f61c028971bd30b9e1909b"},{"type":"PACKAGE","url":"https://github.com/WordOps/WordOps"},{"type":"WEB","url":"https://github.com/WordOps/WordOps/blob/ecf20192c7853925e2cb3f8c8378cd0d86ca0d62/wo/cli/plugins/stack_pref.py#L77"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/wordops/PYSEC-2024-175.yaml"}],"affected":[{"package":{"name":"wordops","ecosystem":"PyPI","purl":"pkg:pypi/wordops"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.0"}]}],"versions":["3.10.0","3.10.1","3.10.2","3.10.3","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.13.0","3.13.1","3.13.2","3.14.0","3.14.1","3.14.2","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.16.0","3.16.1","3.16.2","3.16.3","3.17.0","3.18.0","3.18.1","3.19.0","3.19.1","3.20.0","3.9.9.2","3.9.9.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-23qq-p4gq-gc2g/GHSA-23qq-p4gq-gc2g.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"}]}