CVE-2014-1604
RPLY Predictable Tmpfile Names Allows Cache Spoofing
CVE-2014-1604 is a low vulnerability (CVSS 2.1) in Python Rply, published January 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in rply 0.7.1.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.35%EPSS, 29th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.7.1rply +5 more
Description
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rplyPyPI | before 0.7.1 | 0.7.1 |
python-rplyDebian:12 | before 0.7.1-1 | 0.7.1-1 |
python-rplyDebian:13 | before 0.7.1-1 | 0.7.1-1 |
python-rplyDebian:14 | before 0.7.1-1 | 0.7.1-1 |
rplyPyPI | before 0.7.1, plus listed versions 0.50.5.10.6.00.6.10.7.0 | 0.7.1 |
rplyPyPI | before 0.7.1, plus listed versions 0.50.5.10.6.00.6.10.7.0 Show 5 moreShow lessv0.7.0v0.6.1v0.6v0.5.1v0.5 | 0.7.1 |
What each source reports
NVD Score used
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
CVE-2014-1604- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
CVE-2014-1604- Updated
- 2026-11-02
EUVDEUVD-2014-0102No score
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
EUVD-2014-0102- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9gcf-pq99-rjw3No score
RPLY Predictable Tmpfile Names Allows Cache Spoofing
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
GHSA-9gcf-pq99-rjw3- Weakness
- CWE-377
- Updated
- 2026-11-02
OSVNo score
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
CVE-2014-1604- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-1604No score
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
DEBIAN-CVE-2014-1604- Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-9gcf-pq99-rjw3No score
RPLY Predictable Tmpfile Names Allows Cache Spoofing
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
GHSA-9gcf-pq99-rjw3- Weakness
- CWE-377
- Updated
- 2026-11-02
OSVPYSEC-2014-117No score
Withdrawn as duplicate of PYSEC-2014-17. The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
PYSEC-2014-117- Updated
- 2026-11-02
OSVPYSEC-2014-17No score
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
PYSEC-2014-17- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-1604No score
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
- Record
UBUNTU-CVE-2014-1604- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2014/01/17/8
exchange.xforce.ibmcloud.com/vulnerabilities/90593
osvdb.org/102202
secunia.com/advisories/56429
github.com/alex/rply/commit/fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c
bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-1604
security-tracker.debian.org/tracker/CVE-2014-1604
ubuntu.com/security/CVE-2014-1604
cve.org/CVERecord?id=CVE-2014-1604