Insecure Temporary File Affecting buzz-captions package, versions [0,]

Affected versions of this package are vulnerable to Insecure Temporary File through the use of the deprecated mktemp() function, there is a risk of race conditions. This occurs because the function generates a temporary file name without ensuring exclusive access, allowing an opportunity for an attacker to manipulate the file before it is opened by the original process.

This is only exploitable if the attacker has local access and the ability to execute their own code on the machine.

Note:

import os
import tempfile

# Use tempfile.mktemp() to generate a temporary file path
temp_path = tempfile.mktemp()
print(f"Generated temp file path: {temp_path}")

# Simulate the time window between generating the file path and creating the file,
# during which another program could create a file with the same name.
# An attacker might create a malicious file with the same path.

# The program then tries to use this path to create a file
with open(temp_path, 'w') as f:
    f.write("Sensitive data.")

• Maintainer's Statement
• Security Advisory