Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2023-6597 →
UBUNTU-CVE-2023-6597
An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The te...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:Pro:14.04:LTS
python3.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS
python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.13+esm13"}]}]
Ubuntu:Pro:18.04:LTS
python3.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-2ubuntu1~18.04.2+esm3"}]}]
Ubuntu:Pro:18.04:LTS
python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-3ubuntu1~18.04.2+esm2"}]}]
Ubuntu:20.04:LTS
python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.10-0ubuntu1~20.04.10"}]}]
Ubuntu:Pro:20.04:LTS
python3.9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.5-3ubuntu0~20.04.1+esm2"}]}]
Ubuntu:22.04:LTS
python3.10
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.12-1~22.04.4"}]}]
Ubuntu:Pro:22.04:LTS
python3.11
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0~rc1-1~22.04.1~esm1"}]}]
Références
- advisory ubuntu.com
- report ubuntu.com
- report seclists.org
- report discuss.python.org
- report cve.org
- report github.com