Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2023-6597

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
PSF

Description

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Python Software Foundation CPython

Default version status: unaffected

  • 0 to < 3.8.19affected
  • 3.9.0 to < 3.9.19affected
  • 3.10.0 to < 3.10.14affected
  • 3.11.0 to < 3.11.8affected
  • 3.12.0 to < 3.12.1affected
  • 3.13.0a1 to < 3.13.0a3affected

References