{"id":"CVE-2013-2217","aliases":["DEBIAN-CVE-2013-2217","EUVD-2013-0041","GHSA-vpqp-hx68-p2wx","MGASA-2013-0224","PYSEC-2013-32","PYSEC-2013-33","SUSE-SU-2016:2704-1","openSUSE-SU-2024:10144-1","openSUSE-SU-2024:11275-1","openSUSE-SU-2024:11578-1","openSUSE-SU-2024:12127-1","openSUSE-SU-2025:15105-1"],"status":"published","title":"Improper Link Resolution Before File Access in Suds","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","severity":{"version":"2.0","score":1.2,"vector":"AV:L/AC:H/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00558,"percentile":0.46775,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-59"],"published":"2013-07-21T09:25:10Z","modified":"2026-09-01T20:03:16Z","exploits":[{"source":"pocgithub","id":"Osirium/suds","title":"Osirium/suds","date":"2018-02-22","url":"https://github.com/Osirium/suds"}],"fixes":[{"ecosystem":"PyPI","package":"suds","fixed_in":["1.0.0","0.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"suds-py3","fixed_in":["1.4.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"suds","fixed_in":["0.4.1-8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"suds","fixed_in":["0.4.1-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"suds","fixed_in":["0.4.1-8"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"python-suds","fixed_in":["0.4.1-2.1.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"python-suds","fixed_in":["0.4.1-3.1.mga3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"python-suds-jurko","fixed_in":["0.6-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-suds-jurko","fixed_in":["0.6-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-suds-community","fixed_in":["0.8.5-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-suds","fixed_in":["1.2.0-2.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"suds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4"},{"fixed":"1.0.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"suds-py3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"suds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-8"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"suds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"suds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"suds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}],"versions":["0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4"]},{"source":"osv","ecosystem":"PyPI","package":"suds-py3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4.1"}]}],"versions":["1.0.0.0","1.3.1.0","1.3.2.0","1.3.3.0","1.3.4.0","1.4.0.0","1.4.1.0","1.4.2.0","1.4.3.0"]},{"source":"osv","ecosystem":"Mageia:2","package":"python-suds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-2.1.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"python-suds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-3.1.mga3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"suds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}],"versions":["0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4"]},{"source":"osv","ecosystem":"PyPI","package":"suds-py3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4.1"}]}],"versions":["1.0.0.0","1.3.1.0","1.3.2.0","1.3.3.0","1.3.4.0","1.4.0.0","1.4.1.0","1.4.2.0","1.4.3.0"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-suds-jurko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-suds-jurko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-suds-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-suds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-2.4"}]}]}],"products":[{"vendor":"jeff_ortel","product":"suds"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2008-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=978696","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/06/27/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00062.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2217","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vpqp-hx68-p2wx","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/suds/PYSEC-2013-32.yaml","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/suds-py3/PYSEC-2013-33.yaml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2217","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0224.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10791","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162704-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/827568","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2217","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TSJEZDTS6TFB5Y7YFY6OCIAPP6ADGFJ4/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-2217","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","status":"published","published":"2013-09-23T20:00:00Z","modified":"2024-08-06T15:27:41.254Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-0041","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","status":"published","published":"2013-09-23T20:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-vpqp-hx68-p2wx","title":"Improper Link Resolution Before File Access in Suds","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","status":"published","published":"2022-05-14T01:08:23Z","modified":"2024-10-28T14:37:29Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:38:13.90937Z"}],"nvd":[{"id":"CVE-2013-2217","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","status":"published","published":"2013-09-23T20:55:07.293Z","modified":"2026-06-16T23:52:57.703Z","cvss":[{"version":"2.0","score":1.2,"vector":"AV:L/AC:H/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:02:38.715467Z"}],"osv":[{"id":"GHSA-vpqp-hx68-p2wx","title":"Improper Link Resolution Before File Access in Suds","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","status":"published","published":"2022-05-14T01:08:23Z","modified":"2024-10-28T14:53:28.149849Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"CVE-2013-2217","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","status":"published","published":"2013-09-23T20:55:07Z","modified":"2026-04-16T06:16:04.675880951Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2217","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","status":"published","published":"2013-09-23T20:55:07.293Z","modified":"2026-09-01T20:03:16.262671756Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0224","title":"Updated python-suds package fixes security vulnerability","description":"An insecure temporary directory use flaw was found in the way python-suds\nperformed initialization of its internal file-based URL cache (predictable\nlocation was used for directory to store the cached files). A local attacker\ncould use this flaw to conduct symbolic link attacks, possibly leading to\ntheir ability for example the SOAP .wsdl metadata to redirect queries to a\ndifferent host, than originally intended (CVE-2013-2217).\n","status":"published","published":"2013-07-21T09:25:10Z","modified":"2026-04-16T06:23:41.281143291Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10144-1","title":"python-suds-jurko-0.6-4.1 on GA media","description":"These are all security issues fixed in the python-suds-jurko-0.6-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:03:38.991829Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:11275-1","title":"python36-suds-jurko-0.6-6.9 on GA media","description":"These are all security issues fixed in the python36-suds-jurko-0.6-6.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:47.289573Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11578-1","title":"python36-suds-community-0.8.5-1.1 on GA media","description":"These are all security issues fixed in the python36-suds-community-0.8.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:21:35.228986Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:12127-1","title":"python310-suds-1.1.1-1.1 on GA media","description":"These are all security issues fixed in the python310-suds-1.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:28.510788Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2025:15105-1","title":"python311-suds-1.2.0-2.4 on GA media","description":"These are all security issues fixed in the python311-suds-1.2.0-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T02:56:39.574309Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"PYSEC-2013-32","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","status":"published","published":"2013-09-23T20:55:00Z","modified":"2023-11-08T03:57:18.590032Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"PYSEC-2013-33","description":"cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.","status":"published","published":"2013-09-23T20:55:00Z","modified":"2026-06-10T17:02:42.538346785Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2016:2704-1","title":"Security update for python-suds-jurko","description":"This update for python-suds-jurko fixes the following issues:\n\n- CVE-2013-2217: A temporary directory was used in an insecure fashion when initializing file-based URL cache. (bsc#827568)\n","status":"published","published":"2016-11-02T16:05:34Z","modified":"2025-05-02T04:03:56.838201Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}