CVE-2022-23653: Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
value: B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapping) in a local database file (`$XDG_CONFIG_HOME/b2/account_info`, `~/.b2_account_info` or a user-defined path) when `b2 authorize-account` is first run. This happens regardless of whether a valid key is provided or not. When first created, the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory is readable by a local attacker and the user did not yet run `b2 authorize-account` then during the brief period between file creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information has been saved to it. Users that have not yet run `b2 authorize-account` should upgrade to B2 Command-Line Tool v3.2.1 before running it. Users that have run `b2 authorize-account` are safe if at the time of the file creation no other local users had read access to the local configuration file. Users that have run `b2 authorize-account` where the designated path could be opened by another local user should upgrade to B2 Command-Line Tool v3.2.1 and remove the database and regenerate all application keys. Note that `b2 clear-account` does not remove the database file and it should not be used to ensure that all open handles to the file are invalidated. If B2 Command-Line Tool cannot be upgraded to v3.2.1 due to a dependency conflict, a binary release can be used instead. Alternatively a new version could be installed within a virtualenv, or the permissions can be changed to prevent local users from opening the database file.
CWE description: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
CVSS v3 base score: 4.7
Published: 2022-02-23T23:15Z
Repository: https://github.com/Backblaze/B2_Command_Line_Tool
Language: Other
Files changed: CHANGELOG.md, requirements.txt
Commit date: 2022-02-23 20:20:05 +0100
Commit message: Release v3.2.1

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0b6d3a8..a8eeac3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,10 +4,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [3.2.1] - 2022-02-23
+
+### Fixed
+* Fix setting permissions for local sqlite database (thanks to Jan Schejbal for responsible disclosure!)
+
 ## [3.2.0] - 2021-12-23
 
 ### Added
 * Add compatibility support for arrow >= 1.0.2 on newer Python versions while
   continuing to support Python 3.5
@@ -282,12 +287,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 * File modification times are set correctly when downloading.
 * Fix an off-by-one issue when downloading a range of a file (affects library, but not CLI).
 * Better handling of some errors from the B2 service.
 
-[Unreleased]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.2.0...HEAD
-[3.1.0]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.1.0...v3.2.0
+[Unreleased]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.2.1...HEAD
+[3.2.1]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.2.0...v3.2.1
+[3.2.0]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.1.0...v3.2.0
 [3.1.0]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.0.3...v3.1.0
 [3.0.3]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.0.2...v3.0.3
 [3.0.2]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.0.1...v3.0.2
 [3.0.1]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.0.0...v3.0.1
 [3.0.0]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v2.5.1...v3.0.0
diff --git a/requirements.txt b/requirements.txt
index eed4701..c3c0411 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,8 +1,8 @@
 arrow>=0.8.0,<1.0.0; python_version <= '3.5'
 arrow>=1.0.2,<2.0.0; python_version >= '3.6'
-b2sdk>=1.14.0,<2.0.0
+b2sdk>=1.14.1,<2.0.0
 docutils==0.16
 idna>=2.2.0; platform_system == 'Java'
 importlib-metadata>=2.1.1,<3.0.0; python_version <= '3.5'
 importlib-metadata>=3.3.0; python_version > '3.5' and python_version < '3.8'
 phx-class-registry==3.0.5

Vulnerable code: [Unreleased]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.2.0...HEAD
[3.1.0]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.1.0...v3.2.0
b2sdk>=1.14.0,<2.0.0
Fixed code: ## [3.2.1] - 2022-02-23

### Fixed
* Fix setting permissions for local sqlite database (thanks to Jan Schejbal for responsible disclosure!)

[Unreleased]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.2.1...HEAD
[3.2.1]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.2.0...v3.2.1
[3.2.0]: https://github.com/Backblaze/B2_Command_Line_Tool/compare/v3.1.0...v3.2.0
b2sdk>=1.14.1,<2.0.0