An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1 3.11.7 3.10.13 3.9.18 and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

🗓️ 30 Jun 2024 14:00:00Reported by MicrosoftType

TemporaryDirectory cleanup dereferences symlinks on permission errors, enabling privileged users to modify linked files.

Reporter	Title	Published	Views	Family All 339
ibm	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	8 Aug 202417:29	–	ibm
ibm	Security Bulletin: Vulnerabilities in axios affect IBM Voice Gateway	15 Apr 202502:32	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in IBM Workload Scheduler Container component of IBM Workload Automation Container	11 Mar 202618:41	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	15 Apr 202502:47	–	ibm
ibm	Security Bulletin: Vulnerability in Python CPython affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.	12 Mar 202517:03	–	ibm
ibm	Security Bulletin: Vulnerability in Python affects watsonx.data	5 Sep 202417:56	–	ibm
ibm	Security Bulletin: AIX is affected by multiple vulnerabilities due to Python (CVE-2023-52425, CVE-2023-52426, CVE-2023-6597)	11 Apr 202422:15	–	ibm
nessus	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2024-616)	13 May 202400:00	–	nessus
nessus	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2024-617)	13 May 202400:00	–	nessus
nessus	Amazon Linux 2 : python3 (ALAS-2024-2541)	15 May 202400:00	–	nessus