Critical Vulnerability in Python 3.x Packages: CVE-2023-6597 - Symlink Dereference Issue
Summary
UBUNTU-CVE-2023-6597: An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. Affects python3.4 versions 3.4.0-1 – 3.4~rc3-0ubuntu1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The affected packages, including python3.4, python3.5, python3.7, python3.8, python3.9, python3.10, and python3.11, are essential for running Python applications on Ubuntu systems. These packages provide the core functionality of the Python programming language and are integral to various applications and services. The vulnerability in question affects the tempfile.TemporaryDirectory class, which is responsible for creating temporary directories in a secure manner.
Vulnerability Detail
An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The vulnerability arises from the class's handling of symlinks during cleanup operations. Specifically, it would dereference symlinks when encountering permissions-related errors, potentially allowing users with access to privileged programs to modify the permissions of files referenced by these symlinks. This could lead to unauthorized access or modification of sensitive files, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the tempfile.TemporaryDirectory class in scenarios where symlinks are involved until the package is updated. Consider using alternative methods for creating temporary directories that do not involve symlink dereferencing.
Conclusion
CVE-2023-6597 presents a significant security risk for users of affected Python packages due to its potential for unauthorized file permission modifications. It is crucial to update to the patched versions of the packages as soon as possible to mitigate this vulnerability.
See every vulnerability recorded for python3.4 →
FAQ
CVE-2023-6597 is a vulnerability affecting multiple Python packages that allows symlink dereferencing during cleanup, potentially leading to unauthorized file permission modifications.
The vulnerability affects Python versions 3.4, 3.5, 3.7, 3.8, 3.9, 3.10, and 3.11.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2023-6597 is 7.8, indicating a high severity level.
If immediate updates are not possible, consider implementing the provided workaround by avoiding the use of tempfile.TemporaryDirectory with symlinks.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
