Lucene search

K
redhatcveRedhat.comRH:CVE-2023-6597
HistoryApr 22, 2024 - 8:34 p.m.

CVE-2023-6597

2024-04-2220:34:25
redhat.com
access.redhat.com
48
cve-2023-6597
flaw
temporarydirectory
python3
file permissions
symbolic links

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

6.4

Confidence

High

EPSS

0

Percentile

14.2%

A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link.

Mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

6.4

Confidence

High

EPSS

0

Percentile

14.2%