Incorrect Permission Assignment for Critical Resource Affecting filelock package, versions [3.30.0,4.2.1)

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the strict-mode lock implementation in _strict.py and related soft read-write lock components, where claim directories are created with permissions that allow other local users to list or remove claim files. An attacker sharing the same host can delete a victim process's claim files from the lock's claims directory while the victim holds the lock, causing a second process to enter the critical section concurrently and bypassing the mutual-exclusion guarantee.

Note: This is only exploitable when no other user can replace the lock's directory or any of its ancestors, meaning the attack requires write access to the claims directory itself, which is possible when the victim process runs with a permissive umask (e.g. 0o000) that leaves the claims directory world-writable.

• GitHub Advisory
• GitHub Commit
• GitHub PR