filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

影響: pip:filelock >= 3.22.0, <= 4.2.0 → 4.2.1

SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async variants and a FileLock that has fallen back to a soft lock on ENOSYS decide from the record inside the marker file whether its owner is gone. The marker is the file whose presence says a process holds the lock. They do not check who could have written that record. A local user who can write the marker but cannot remove it rewrites the holder's record to name a dead PID (process id). That position arises with an explicit mode with gro…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:08, GitHub Advisory Database에서 "filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-112939.