CVE-2023-6597: Security fixes in Python 3.10.14, 3.9.19, and 3.8.19 (CVE-2023-6597 & CVE-2024-0450)
An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1 3.11.7 3.10.13 3.9.18 and 3.8.18 and prior.
The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
Other sources
An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.5+dfsg-2+deb11u4Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-2 - Upgrade
Upgrade
debian/python2.7to a version that resolves this vulnerability.Fixed in 2.7.18-8+deb11u1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u5Fixed in 3.11.2-6+deb12u3 - Upgrade
Upgrade
debian/python3.12to a version that resolves this vulnerability.Fixed in 3.12.10-1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1+deb11u3 - Upgrade
Upgrade
CPython (tempfile.TemporaryDirectory)to a version that resolves this vulnerability.Fixed in 3.10.14Patch CVE-2023-6597 - Upgrade
Upgrade
CPython (tempfile.TemporaryDirectory)to a version that resolves this vulnerability.Fixed in 3.9.19Patch CVE-2024-0450 - Upgrade
Upgrade
CPython (tempfile.TemporaryDirectory)to a version that resolves this vulnerability.Fixed in 3.8.19Patch CVE-2023-6597
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6597?
CVE-2023-6597 has a medium severity rating due to its impact on users who can create symbolic links.
How do I fix CVE-2023-6597?
To fix CVE-2023-6597, upgrade to the latest version of the affected Python packages, such as python3.12 version 3.12.8-5 or higher.
Which versions of Python are affected by CVE-2023-6597?
CVE-2023-6597 affects Python versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
What is the main issue with CVE-2023-6597?
The main issue with CVE-2023-6597 is that the tempfile.TemporaryDirectory class dereferences symlinks during cleanup of permissions-related errors.
Who is impacted by CVE-2023-6597?
In CVE-2023-6597, users who can create symbolic links are impacted due to potential security risks during temporary directory cleanup.