filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1

SoftFileLock and MarkerSoftFileLock evict an unparsable marker (the lock file at , whose presence says a process holds the lock) once a waiting contender has watched it unchanged for two seconds. SoftFileLease expires a lease the same way. The watch tells two looks apart by the marker's modification time (mtime) and inode number (the kernel's identity for a file, independent of its name) alone. Another local user (the other user below) who can create files in the lock's directory, a sticky /tmp…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 07:00, GitHub Advisory Database에서 "filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-112906.