DEBIAN-CVE-2026-112937
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-112937
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112937.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-112937
- Upstream
- Published
- 2026-10-20T15:17:16Z
- Modified
- 2026-10-23T16:02:43Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
- Summary
- [none]
- Details
-
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1.
- References
Affected packages
Debian:12 / python-filelock
Package
- Name
- python-filelock
- Purl
- pkg:deb/debian/python-filelock?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
3.*
3.9.0-1
3.9.0-1+deb12u1
3.12.2-1
3.12.3-1
3.12.4-1
3.13.1-1
3.13.3-1
3.13.4-1
3.14.0-1
3.15.4-1
3.16.1-1
3.16.1-2
3.17.0-1
3.18.0-1
3.19.1-1
3.20.0-1
3.20.2-1
3.20.3-1
3.24.3-1
3.25.0-1
3.25.2-1
3.29.0-1
3.29.4-1
3.29.5-1
3.29.7-1
3.32.0-1
3.32.2-1
3.32.4-1
3.32.4-2
3.32.5-1
3.32.6-1
4.*
4.0.1-1
4.0.12-1
4.1.1-1
Debian:13 / python-filelock
Package
- Name
- python-filelock
- Purl
- pkg:deb/debian/python-filelock?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / python-filelock
Package
- Name
- python-filelock
- Purl
- pkg:deb/debian/python-filelock?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected