CVE-2023-6507

Katalog CVE

CVSS 4.9 · Medium EPSS 1,3%

Kerentanan Improper Privilege Management pada python. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).

Rincian

Terbit di NVD

8 Desember 2023

Terakhir diubah

31 Juli 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python/cpython/issues/112334 issue tracking · patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/AUL7QFHBLILGISS7U63B47AYSSGJJQZD/ advisory pihak ketiga
• https://github.com/python/cpython/commit/10e9bb13b8dcaa414645b9bd10718d8f7179e82b
• https://github.com/python/cpython/commit/85bbfa8a4bbdbb61a3a84fbd7cb29a4096ab8a06
• https://github.com/python/cpython/commit/9fe7655c6ce0b8e9adc229daf681b6d30e6b1610