Skip to content
fr Sign in
7.8 High

CVE-2023-6597 An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13,…

Description

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

Affected products and versions

Product Affected versions Fixed in
cpython 3.13 3.13.0a1 → < 3.13.0a3 3.13.0a3
cpython 3.12 3.12.0 → < 3.12.1 3.12.1
cpython 3.11 3.11.0 → < 3.11.8 3.11.8
cpython 3.10 3.10.0 → < 3.10.14 3.10.14
cpython 3.9 3.9.0 → < 3.9.19 3.9.19
cpython 3.8 earliest → < 3.8.19 3.8.19
CPython 3.13 3.13.0a1 → < 3.13.0a3 3.13.0a3
CPython 3.12 3.12.0 → < 3.12.1 3.12.1
CPython 3.11 3.11.0 → < 3.11.8 3.11.8
Show the 3 other branches
Product Affected versions Fixed in
CPython 3.10 3.10.0 → < 3.10.14 3.10.14
CPython 3.9 3.9.0 → < 3.9.19 3.9.19
CPython 3.8 earliest → < 3.8.19 3.8.19

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cpython

The 5 CVEs of cpython →
CVE-2024-12254 Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and… 8.7 High CVE-2024-11168 The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that… 6.3 Medium CVE-2024-8088 There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path" 8.7 High CVE-2024-0397 A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext… 7.4 High
Track this CVE