PT-2024-7267 · Python+1 · Python+1
Aobo Wang
+1
·
Published
2024-05-07
·
Updated
2025-11-07
·
CVE-2024-4030
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
Python versions prior to 3.13
Description:
The issue is related to the
tempfile.mkdtemp() function in Python, which on Windows, may not always set the correct permissions for the temporary directory, allowing other users to read and write to it. This is due to Python not supporting Unix permissions on Windows. The fix adds support for Unix "700" permissions for the mkdir function on Windows, ensuring the newly created directory has the proper permissions. If you are not using Windows or haven't changed the temporary directory location, you are not affected by this issue. On other platforms, the returned directory is consistently readable and writable only by the current user.Recommendations:
Update Python to version 3.13 to resolve the issue. As a temporary workaround, consider restricting access to the temporary directory created by
tempfile.mkdtemp() to minimize the risk of exploitation. Avoid using the tempfile.mkdtemp() function on Windows until the issue is resolved.Fix
Incorrect Default Permissions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Python
Suse