CVE-2023-6507

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6507
An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/python/cpython/issues/112334 Issue Tracking Patch
https://github.com/python/cpython/pull/112617 Issue Tracking Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/AUL7QFHBLILGISS7U63B47AYSSGJJQZD/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:python:python:3.12.0:-:*:*:*:*:*:*
cpe:2.3:a:python:python:3.13.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.13.0:alpha2:*:*:*:*:*:*
History

13 Dec 2023, 20:17

Type Values Removed Values Added
Summary
  • (es) Se encontró un problema en el módulo `subproceso` de CPython 3.12.0 en plataformas POSIX. El problema se solucionó en CPython 3.12.1 y no afecta a otras versiones estables. Cuando se utiliza el parámetro `extra_groups=` con una lista vacía como valor (es decir, `extra_groups=[]`), la lógica retrocede para no llamar a `setgroups(0, NULL)` antes de llamar a `exec()`, por lo que no se descarta el grupos de procesos originales antes de iniciar el nuevo proceso. No hay ningún problema cuando no se usa el parámetro o cuando se usa cualquier valor además de una lista vacía. Este problema solo afecta los procesos de CPython que se ejecutan con privilegios suficientes para realizar la llamada al sistema "setgroups" (normalmente "root").
First Time Python
Python python
CWE NVD-CWE-noinfo
References () https://github.com/python/cpython/issues/112334 - () https://github.com/python/cpython/issues/112334 - Issue Tracking, Patch
References () https://github.com/python/cpython/pull/112617 - () https://github.com/python/cpython/pull/112617 - Issue Tracking, Patch
References () https://mail.python.org/archives/list/security-announce@python.org/thread/AUL7QFHBLILGISS7U63B47AYSSGJJQZD/ - () https://mail.python.org/archives/list/security-announce@python.org/thread/AUL7QFHBLILGISS7U63B47AYSSGJJQZD/ - Third Party Advisory
CPE cpe:2.3:a:python:python:3.13.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.13.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.12.0:-:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : 4.9

08 Dec 2023, 20:18

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-08 19:15

Updated : 2023-12-13 20:17

NVD link : CVE-2023-6507

Mitre link : CVE-2023-6507

CVE.ORG link : CVE-2023-6507

JSON object : View

Products Affected

python

  • python
CWE
NVD-CWE-noinfo CWE-269

Improper Privilege Management