{"id":"UBUNTU-CVE-2026-112938","details":"filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through _open_directory by pathname, allowing a local account that can rename the coordination name to swap in a symbolic link between check and use during acquisition. That race can create and leave claim files in another writable directory or strand claims in a different strict lock so the second lock times out. Separately, the claims property and force_break follow a resting symbolic link without a race when the lock user inspects or recovers the lock. Claims inspection discloses a file name to the other account only if the resulting exception text or claim_name reaches that account through a shared log, CI output, or error report. A blind force_break recovery that removes live claims from another strict lock can allow two processes into that lock's critical section; this path reaches other strict locks, not arbitrary files. This issue is fixed in version 4.2.1.","modified":"2026-11-07T01:45:04.646603936Z","published":"2026-11-06T00:00:00Z","upstream":["CVE-2026-112938"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-112938"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-112938"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/pull/839"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"affected":[{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.11-1","2.0.12-1","2.0.13-1","3.0.0-2","3.0.3-1","3.0.4-1","3.0.4-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"python-filelock","binary_version":"3.0.4-1ubuntu0.1~esm1"},{"binary_name":"python3-filelock","binary_version":"3.0.4-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112938.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.12-1","3.0.12-2","3.0.12-2ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.0.12-2ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112938.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.12-2","3.3.2-1","3.4.0-1","3.4.2-1","3.4.2-2","3.6.0-1","3.6.0-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.6.0-1ubuntu0.1~esm1","binary_name":"python3-filelock"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112938.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.2-1","3.12.4-1","3.13.1-1","3.13.1-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.13.1-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112938.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20.3-1","3.29.4-1","3.32.0-1","3.32.2-1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.32.2-1","binary_name":"python3-filelock"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112938.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18.0-1","3.20.0-1","3.20.2-1","3.20.3-1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.20.3-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112938.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H"},{"type":"Ubuntu","score":"medium"}]}