Lack of data validation - Path Traversal In python3
Description
An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel8 | 0:3.9.19-1.module+el8.10.0+21815+bb024982 | ||
 alpine v3.16 | 3.10.14-r0 | ||
alpine v3.17 | 3.10.14-r0 | ||
 debian 12 | 7.3.11+dfsg-2+deb12u2 | ||
debian 13 | 7.3.13+dfsg-1 | ||
debian 14 | 7.3.13+dfsg-1 | ||
debian 12 | 3.11.2-6+deb12u2 | ||
 pypi | 3.8.19, 3.9.19, 3.10.14, 3.11.8, 3.12.1, 3.13.0a3 | ||
rpm rhel8 | 0:3.11.9-1.el8_10 | ||
rpm rhel8 | 0:3.9.19-1.module+el8.10.0+21815+bb024982 |
1-10 of 17
10
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10.