Every CVE Search/ Get API key

CVE-2014-2667

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when...

3.3 LowFix available

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Exploit likelihood

0.36%Down 0.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 3.3

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
CVE-2014-2667
CVSS 2.0
3.3 LowAV:L/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-362
Updated
2026-11-02
CVE List No score

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
CVE-2014-2667
Updated
2026-11-02
EUVDEUVD-2014-2699 No score

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
EUVD-2014-2699
Updated
2026-11-03
GitHub AdvisoriesGHSA-gqp4-ww82-42w3 No score

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when...

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
GHSA-gqp4-ww82-42w3
Weakness
CWE-362
Updated
2026-11-02
OSVMGASA-2014-0216 No score

Updated python3 packages fix security vulnerability

It was reported that a patch added to Python 3.2 caused a race condition where a file created could be created with world read/write permissions instead of the permissions dictated by the original umask of the process. This could allow a local attacker that could win the race to view and edit files created by a program using this call. Note that prior versions of Python, including 2.x, do not include the vulnerable _get_masked_mode() function that is used by os.makedirs() when exist_ok is set to True (CVE-2014-2667).

Record
MGASA-2014-0216
Updated
2026-11-02
OSVopenSUSE-SU-2020:0086-1 No score

Security update for python3

This update for python3 to version 3.6.10 fixes the following issues:

  • CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
  • CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
  • CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0086-1
Updated
2026-11-02
Show 14 moreShow less
OSVopenSUSE-SU-2024:10426-1 No score

libpython3_5m1_0-3.5.1-3.6 on GA media

These are all security issues fixed in the libpython3_5m1_0-3.5.1-3.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10426-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11283-1 No score

python310-3.10.0rc1-4.2 on GA media

These are all security issues fixed in the python310-3.10.0rc1-4.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11283-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11284-1 No score

python36-3.6.15-1.1 on GA media

These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11284-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11285-1 No score

python38-3.8.12-1.2 on GA media

These are all security issues fixed in the python38-3.8.12-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11285-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11286-1 No score

python39-3.9.7-2.1 on GA media

These are all security issues fixed in the python39-3.9.7-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11286-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12089-1 No score

python311-3.11.0b1-1.1 on GA media

These are all security issues fixed in the python311-3.11.0b1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12089-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12910-1 No score

python312-3.12.0a7-1.1 on GA media

These are all security issues fixed in the python312-3.12.0a7-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12910-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14109-1 No score

python313-3.13.0~b3-1.1 on GA media

These are all security issues fixed in the python313-3.13.0~b3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14109-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14434-1 No score

python314-3.14.0~a1-1.1 on GA media

These are all security issues fixed in the python314-3.14.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14434-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15713-1 No score

python315-3.15.0~a1-1.1 on GA media

These are all security issues fixed in the python315-3.15.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15713-1
Updated
2026-11-02
OSVPSF-2014-5 No score

os.makedirs() not thread-safe

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
PSF-2014-5
Updated
2026-11-02
OSVSUSE-FU-2022:0444-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Track already fixed issues.
Record
SUSE-FU-2022:0444-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-SU-2020:0114-1 No score

Security update for python3

This update for python3 to version 3.6.10 fixes the following issues:

  • CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
  • CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
  • CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).
Record
SUSE-SU-2020:0114-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python3
Mageia:3
 before 3.3.0-4.8.mga3
3.3.0-4.8.mga3
python3
Mageia:4
 before 3.3.2-13.3.mga4
3.3.2-13.3.mga4
python3
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 26 CVEs
 before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 26 CVEs
 before 3.6.10-3.42.2
3.6.10-3.42.2
python3
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 26 CVEs
 before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 26 CVEs
 before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Development Tools 15
From an advisory covering 26 CVEs
 before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Development Tools 15 SP1
From an advisory covering 26 CVEs
 before 3.6.10-3.42.2
3.6.10-3.42.2
python3
openSUSE:Leap 15.1
From an advisory covering 26 CVEs
 before 3.6.10-lp151.6.7.1
3.6.10-lp151.6.7.1
python3-base
openSUSE:Leap 15.1
From an advisory covering 26 CVEs
 before 3.6.10-lp151.6.7.1
3.6.10-lp151.6.7.1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
python310
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 3.10.0rc1-4.2
3.10.0rc1-4.2
python36
openSUSE:Tumbleweed
From an advisory covering 39 CVEs
 before 3.6.15-1.1
3.6.15-1.1
python38
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 3.8.12-1.2
3.8.12-1.2
python39
openSUSE:Tumbleweed
From an advisory covering 20 CVEs
 before 3.9.7-2.1
3.9.7-2.1
python311
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 3.11.0b1-1.1
3.11.0b1-1.1
python312
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 3.12.0a7-1.1
3.12.0a7-1.1
python313
openSUSE:Tumbleweed
From an advisory covering 28 CVEs
 before 3.13.0~b3-1.1
3.13.0~b3-1.1
python314
openSUSE:Tumbleweed
From an advisory covering 33 CVEs
 before 3.14.0~a1-1.1
3.14.0~a1-1.1
python315
openSUSE:Tumbleweed
From an advisory covering 39 CVEs
 before 3.15.0~a1-1.1
3.15.0~a1-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-2667 is a low vulnerability (CVSS 3.3) in Python, published May 14, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in python3 3.3.0-4.8.mga3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 555 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open