CVE-2023-6597
Publication date 19 March 2024
Last updated 24 June 2025
Ubuntu priority
Description
An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
Mitigation
allenpthuang> https://bugs.python.org/issue26660
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| python2.7 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
|
| python3.4 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 14.04 LTS trusty |
Needs evaluation
|
|
| python3.5 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 16.04 LTS xenial |
Fixed 3.5.2-2ubuntu0~16.04.13+esm13
|
|
| 14.04 LTS trusty |
Not affected
|
|
| python3.6 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Not affected
|
|
| python3.7 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Fixed 3.7.5-2ubuntu1~18.04.2+esm3
|
|
| python3.8 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Fixed 3.8.10-0ubuntu1~20.04.10
|
|
| 18.04 LTS bionic |
Fixed 3.8.0-3ubuntu1~18.04.2+esm2
|
|
| python3.9 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Fixed 3.9.5-3ubuntu0~20.04.1+esm2
|
|
| python3.10 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Fixed 3.10.12-1~22.04.4
|
|
| 20.04 LTS focal | Not in release | |
| python3.11 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Fixed 3.11.0~rc1-1~22.04.1~esm1
|
|
| 20.04 LTS focal | Not in release | |
| python3.12 | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
allenpthuang
this was introduced in https://github.com/python/cpython/pull/10320/commits/dcd67c568a477ddf7524e373ac266d2f087e5665
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.8 · High
|
| Attack vector | Local |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-6891-1
- Python vulnerabilities
- 11 July 2024