CVE-2014-1604: The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local us...

Security readout for executives and security teams

CVE-2014-1604 is an old local issue in RPLY, also packaged as python-rply. Before version 0.7.1, its parser cache used predictable temporary JSON filenames, allowing a local user on the same system to pre-create spoofed cache data. The provided sources do not show remote exposure or confirmed active exploitation. Exposure is most likely on systems that still run RPLY/python-rply before 0.7.1, especially shared hosts, build machines, or multi-user development environments where untrusted local users can write to temporary directories. Treat this as a low-priority legacy dependency hygiene item unless affected RPLY versions run on shared systems with untrusted local users. Prioritize normal upgrade cycles and exposure verification over emergency response. Mitigation focus: Inventory RPLY or python-rply usage across applications and build environments.; Upgrade RPLY/python-rply to 0.7.1 or later where packaging supports it.; Check Debian or vendor package guidance for fixed backports..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.