Tsigouris007

Using the `CookieJar.load()` function with untrusted input may allow arbitrary code execution. This issue is unlikely to affect many applications as most use this function with the user's own data.

A command injection issue exists in the `click.edit()` function, which allows an unprivileged account to execute arbitrary operating system commands.

The `set key()` and `unset key()` functions in python-dotenv follow symbolic links when rewriting .env files. This occurs when the `rewrite()` context manager in `dotenv/main.py` writes to a temporary file in the system default directory and attempts to move it to the target location using `shutil.move()`. If the target is a symbolic link and the temporary directory is on a different filesystem, `shutil.move()` falls back to `shutil.copy2()`, which follows symbolic links by default. A local attacker with write access to the directory containing the .env file can create a crafted symlink to overwrite arbitrary files that the application process has permission to modify, potentially leading to integrity violations, denial of service, or privilege escalation.

The `save external data()` function constructs an external-data file path using the `external data` location field and opens it for writing without using `O NOFOLLOW` or `O EXCL` flags, following a non-atomic `os.path.isfile()` check. A local attacker with write access to the directory where external data is serialized can create a symbolic link (symlink) that is followed by the application. This allows the attacker to cause the application to append data to any file the victim has permissions to write, such as application configurations, cron files, or `~/.ssh/authorized keys`.

jaraco.context, a software package providing decorators and context managers, contains a path traversal issue in the `jaraco.context.tarball()` function. The issue allows attackers to extract files outside the intended directory when processing malicious tar archives. The vulnerability arises because the `strip first component` filter incorrectly handles `../` sequences within paths, enabling traversal attacks. This is also susceptible to nested tarball attacks involving multi-level tar files. The `tarball()` function is vulnerable.

A race condition exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a timing issue between permission validation and file creation. This race condition occurs in the ` acquire()` method between `raise on not writable file()` and `os.open()`. An attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.

pyasn1, a generic ASN.1 library for Python, contains a denial-of-service issue. The issue stems from incorrect handling of malformed RELATIVE-OIDs with excessive continuation octets during decoding. An attacker can exploit this by providing a crafted input that causes the library to consume excessive memory, potentially leading to a denial of service. The vulnerability is triggered by the `decode` function when processing maliciously crafted ASN.1 data. The issue can affect systems utilizing pyasn1 for tasks such as LDAP servers, TLS/SSL endpoints, and OCSP responders. A proof-of-concept demonstrates the ability to exhaust memory by sending a payload with numerous continuation octets.

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, Time-of-Check-Time-of-Use (TOCTOU) vulnerabilities exist in virtualenv that allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app data and lock file operations to attacker-controlled locations. The vulnerability affects the `directory creation` operations.