python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, set_key() and unset_key() in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
Weakness
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Python-dotenv | Saurabh-kumar | * | 1.2.2 (excluding) |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/lightspeed-chatbot-rhel9:1780102732 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/mcp-tools-rhel9:1779772877 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-feature-server-rhel9:1780069135 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-kserve-storage-initializer-rhel9:1780069127 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-vllm-gaudi-rhel9:1780069069 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-feature-server-rhel9:1778239104 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-mlserver-rhel9:1778262856 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-cuda128-torch29-py312-rhel9:1779123334 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-vllm-gaudi-rhel9:1778600187 | * |
| Red Hat Satellite 6.18 | RedHat | satellite/iop-host-inventory-rhel9:1780414237 | * |
Potential Mitigations
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/132.html
- https://cwe.mitre.org/data/definitions/17.html
- https://cwe.mitre.org/data/definitions/35.html
- https://cwe.mitre.org/data/definitions/76.html
References
- https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311
- https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2
- https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94
- https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94