CVE-2013-4235 | login (CWE-367)

[yeyisan]

A low severity vulnerability has been discovered in your project.

Project Name: NodeJS2

Scanner Name: trivy

Cwe ID: 367

Cwe Name: Time-of-check Time-of-use (TOCTOU) Race Condition

Cwe Link: https://cwe.mitre.org/data/definitions/367.html

CVE ID: CVE-2013-4235

Target: redis:latest (debian 11.3)

Packages:

• login : 1:4.8.1-1 - Fixed Version:

References:

• https://access.redhat.com/security/cve/cve-2013-4235
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• https://security-tracker.debian.org/tracker/CVE-2013-4235

Training(Secure Code Warrior):

• Name: Time-of-check Time-of-use (TOCTOU) Race Condition

• Description: The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.

• Link: https://portal.securecodewarrior.com/?utm_source=partner-integration:kondukto#/website-trial/web/blog/generic

• Videos:

  • https://media.securecodewarrior.com/v2/Business_Logic_v2.mp4

Tool Description: shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

Custom Description: bhhh