CVE-2023-6597
An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The t...
Original description
The description as published by the source.
An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-6597 pypy3 Fixed in: 7.3.5+dfsg-2+deb11u3
- Ubuntu UBUNTU-CVE-2023-6597 python3.4
References
- advisory github.com
- advisory mail.python.org
- advisory nvd.nist.gov
- package github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- report github.com
- web openwall.com
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org