filelock

Security advisories14

• filelock: filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale breakfixed in 4.2.1
• filelock: filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live holdfixed in 4.2.1
• filelock: filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathfixed in 4.2.1
• filelock: filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLfixed in 4.2.1
• filelock: filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionfixed in 4.2.1
• filelock: filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its databasefixed in 4.2.1
• filelock: filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutfixed in 4.2.1
• filelock: filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersfixed in 4.2.1
• filelock: filelock: ReadWriteLock follows a symlink at the lock path into SQLitefixed in 4.0.9
• filelock: filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user choosesfixed in 4.2.1
• filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockfixed in 3.20.3
• filelock: filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markerfixed in 4.2.1
• filelock: filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own filesfixed in 4.2.1
• filelock: filelock has a TOCTOU race condition which allows symlink attacks during lock file creationfixed in 3.20.1

Versions that change something