PT-2023-8833 · Python+11 · Cpython+11
Ee Durbin
·
Published
2023-12-08
·
Updated
2025-08-11
·
CVE-2023-6597
CVSS v3.1
7.8
High
| Vector | AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
CPython versions 3.12.1 through 3.12.1
CPython versions 3.11.7 through 3.11.7
CPython versions 3.10.13 through 3.10.13
CPython versions 3.9.18 through 3.9.18
CPython versions 3.8.18 and prior
Description
The issue is related to the
tempfile.TemporaryDirectory class in CPython, which would dereference symlinks during cleanup of permissions-related errors. This could allow users who can run privileged programs to modify permissions of files referenced by symlinks in some circumstances.Recommendations
For CPython versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior, consider disabling the
tempfile.TemporaryDirectory class until a patch is available.
Restrict access to the tempfile module to minimize the risk of exploitation.
Avoid using the tempfile.TemporaryDirectory class in situations where symlinks are involved until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Cpython
Centos
Ibm Aix
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node