Description
Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.
Remediation
References
Related Vulnerabilities
WordPress Plugin Easy Custom Auto Excerpt Cross-Site Scripting (2.4.6)
WordPress Plugin Gallery transformation SQL Injection (1.0)
WordPress Plugin OneLogin SAML SSO Security Bypass (2.2.0)
Joomla! Core Security Bypass (2.5.0 - 3.9.19)
WordPress Plugin Hungred Post Thumbnail 'hpt_file_upload.php' Arbitrary File Upload (2.1.9)