Every CVESearch/Get API key

CVE-2014-2667

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when...

3.3 LowFix available

CVE-2014-2667 is a low vulnerability (CVSS 3.3) in Python, published May 14, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in python3 3.3.0-4.8.mga3.

What does this mean?
Severity
3.3 LowCVSS 2.0, NVD
Exploit chance
0.36%EPSS, 29th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.3.0-4.8.mga3python3 +18 more

Description

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Exploit likelihood

0.36%Down 0.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python3
Mageia:3
before 3.3.0-4.8.mga3
3.3.0-4.8.mga3
python3
Mageia:4
before 3.3.2-13.3.mga4
3.3.2-13.3.mga4
python3
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Development Tools 15
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Development Tools 15 SP1
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3
openSUSE:Leap 15.1
From an advisory covering 26 CVEs
before 3.6.10-lp151.6.7.1
3.6.10-lp151.6.7.1
python3-base
openSUSE:Leap 15.1
From an advisory covering 26 CVEs
before 3.6.10-lp151.6.7.1
3.6.10-lp151.6.7.1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
python310
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
before 3.10.0rc1-4.2
3.10.0rc1-4.2
python36
openSUSE:Tumbleweed
From an advisory covering 39 CVEs
before 3.6.15-1.1
3.6.15-1.1
python38
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
before 3.8.12-1.2
3.8.12-1.2
python39
openSUSE:Tumbleweed
From an advisory covering 20 CVEs
before 3.9.7-2.1
3.9.7-2.1
python311
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
before 3.11.0b1-1.1
3.11.0b1-1.1
python312
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
before 3.12.0a7-1.1
3.12.0a7-1.1
python313
openSUSE:Tumbleweed
From an advisory covering 28 CVEs
before 3.13.0~b3-1.1
3.13.0~b3-1.1
python314
openSUSE:Tumbleweed
From an advisory covering 33 CVEs
before 3.14.0~a1-1.1
3.14.0~a1-1.1
python315
openSUSE:Tumbleweed
From an advisory covering 39 CVEs
before 3.15.0~a1-1.1
3.15.0~a1-1.1

What each source reports

NVD Score used3.3

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
CVE-2014-2667
CVSS 2.0
3.3 LowAV:L/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-362
Updated
2026-11-02
CVE ListNo score

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
CVE-2014-2667
Updated
2026-11-02
EUVDEUVD-2014-2699No score

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
EUVD-2014-2699
Updated
2026-11-03
GitHub AdvisoriesGHSA-gqp4-ww82-42w3No score

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when...

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
GHSA-gqp4-ww82-42w3
Weakness
CWE-362
Updated
2026-11-02
OSVMGASA-2014-0216No score

Updated python3 packages fix security vulnerability

It was reported that a patch added to Python 3.2 caused a race condition where a file created could be created with world read/write permissions instead of the permissions dictated by the original umask of the process. This could allow a local attacker that could win the race to view and edit files created by a program using this call. Note that prior versions of Python, including 2.x, do not include the vulnerable _get_masked_mode() function that is used by os.makedirs() when exist_ok is set to True (CVE-2014-2667).

Record
MGASA-2014-0216
Updated
2026-11-02
OSVopenSUSE-SU-2020:0086-1No score

Security update for python3

This update for python3 to version 3.6.10 fixes the following issues:

  • CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
  • CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
  • CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0086-1
Updated
2026-11-02
Show 14 moreShow less
OSVopenSUSE-SU-2024:10426-1No score

libpython3_5m1_0-3.5.1-3.6 on GA media

These are all security issues fixed in the libpython3_5m1_0-3.5.1-3.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10426-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11283-1No score

python310-3.10.0rc1-4.2 on GA media

These are all security issues fixed in the python310-3.10.0rc1-4.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11283-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11284-1No score

python36-3.6.15-1.1 on GA media

These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11284-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11285-1No score

python38-3.8.12-1.2 on GA media

These are all security issues fixed in the python38-3.8.12-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11285-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11286-1No score

python39-3.9.7-2.1 on GA media

These are all security issues fixed in the python39-3.9.7-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11286-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12089-1No score

python311-3.11.0b1-1.1 on GA media

These are all security issues fixed in the python311-3.11.0b1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12089-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12910-1No score

python312-3.12.0a7-1.1 on GA media

These are all security issues fixed in the python312-3.12.0a7-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12910-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14109-1No score

python313-3.13.0~b3-1.1 on GA media

These are all security issues fixed in the python313-3.13.0~b3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14109-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14434-1No score

python314-3.14.0~a1-1.1 on GA media

These are all security issues fixed in the python314-3.14.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14434-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15713-1No score

python315-3.15.0~a1-1.1 on GA media

These are all security issues fixed in the python315-3.15.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15713-1
Updated
2026-11-02
OSVPSF-2014-5No score

os.makedirs() not thread-safe

Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

Record
PSF-2014-5
Updated
2026-11-02
OSVSUSE-FU-2022:0444-1No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Track already fixed issues.
Record
SUSE-FU-2022:0444-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-SU-2020:0114-1No score

Security update for python3

This update for python3 to version 3.6.10 fixes the following issues:

  • CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
  • CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
  • CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).
Record
SUSE-SU-2020:0114-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 555 references. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open