CVE-2023-6597

2024-03-1916:15:08

[email protected]

web.nvd.nist.gov

cve-2023-6597

cpython

tempfile

temporarydirectory

security vulnerability

symlink

permissions

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.3%

JSON

An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.

The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CPython",
    "repo": "https://github.com/python/cpython",
    "vendor": "Python Software Foundation",
    "versions": [
      {
        "version": "0",
        "lessThan": "3.8.19",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.9.0",
        "lessThan": "3.9.19",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.10.0",
        "lessThan": "3.10.14",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.11.0",
        "lessThan": "3.11.8",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.12.0",
        "lessThan": "3.12.1",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.13.0a1",
        "lessThan": "3.13.0a3",
        "status": "affected",
        "versionType": "python"
      }
    ]
  }
]