CVE Feed

    Dashboard / CVE / CVE-2023-6597

    CVE-2023-6597

    An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

    Published:Mar 19, 2024
    Last Modified:Apr 15, 2026
    EPS:Mar 19, 2024
    EPSS Score:0.00077
    CVSS Score:7.8

    Affected Products

    Vendor
    Python Software Foundation
    Product
    Cpython
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Openshift
    Vendor
    Redhat
    Product
    Rhel Aus
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Tus
    Vendor
    Redhat
    Product
    Service Interconnect

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-27 Leveraging Race Conditions via Symbolic Links

    Related CVEs

    CVE-2025-6075 (CVSS 1.8) — If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when exp…
    CVE-2024-12254 (CVSS 8.7) — Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing…
    CVE-2024-11168 (CVSS 6.3) — The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hos…
    CVE-2024-8088 (CVSS 8.7) — There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note t…
    CVE-2024-3219 (CVSS 5.1) — The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that d…
    CVE-2024-0397 (CVSS 7.4) — A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLCont…

    References

    http://www.openwall.com/lists/oss-security/2024/03/20/5
    https://github.com/python/cpython/commit/02a9259c717738dfe6b463c44d7e17f2b6d2cb3a
    https://github.com/python/cpython/commit/5585334d772b253a01a6730e8202ffb1607c3d25
    https://github.com/python/cpython/commit/6ceb8aeda504b079fef7a57b8d81472f15cdd9a5
    https://github.com/python/cpython/commit/81c16cd94ec38d61aa478b9a452436dc3b1b524d
    https://github.com/python/cpython/commit/8eaeefe49d179ca4908d052745e3bb8b6f238f82
    https://github.com/python/cpython/commit/d54e22a669ae6e987199bb5d2c69bb5a46b0083b
    https://github.com/python/cpython/issues/91133
    https://lists.debian.org/debian-lts-announce/2024/03/msg00025.html
    https://lists.fedoraproject.org/archives/list/[email protected]/message/T3IGRX54M7RNCQOXVQO5KQKTGWCOABIM/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/U5VHWS52HGD743C47UMCSAK2A773M2YE/
    https://mail.python.org/archives/list/[email protected]/thread/Q5C6ATFC67K53XFV4KE45325S7NS62LD/
    http://www.openwall.com/lists/oss-security/2024/03/20/5
    https://github.com/python/cpython/commit/02a9259c717738dfe6b463c44d7e17f2b6d2cb3a
    https://github.com/python/cpython/commit/5585334d772b253a01a6730e8202ffb1607c3d25
    https://github.com/python/cpython/commit/6ceb8aeda504b079fef7a57b8d81472f15cdd9a5
    https://github.com/python/cpython/commit/81c16cd94ec38d61aa478b9a452436dc3b1b524d
    https://github.com/python/cpython/commit/8eaeefe49d179ca4908d052745e3bb8b6f238f82
    https://github.com/python/cpython/commit/d54e22a669ae6e987199bb5d2c69bb5a46b0083b
    https://github.com/python/cpython/issues/91133
    https://lists.debian.org/debian-lts-announce/2024/03/msg00025.html
    https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html
    https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
    https://lists.fedoraproject.org/archives/list/[email protected]/message/T3IGRX54M7RNCQOXVQO5KQKTGWCOABIM/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/U5VHWS52HGD743C47UMCSAK2A773M2YE/
    https://mail.python.org/archives/list/[email protected]/thread/Q5C6ATFC67K53XFV4KE45325S7NS62LD/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High