Creation of temporary file in directory with insecure permissions in pyinstaller - CVE-2023-49797

Vulnerability identifier: #VU84379

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-49797

CWE-ID: CWE-379

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to delete arbitrary files on the system.

The vulnerability exists due to matplotlib and win32com applications use a temporary directory with insecure permissions. A local user can create symbolic links to critical files on the system and delete these files.

pyinstaller
Intel In-Band Manageability
Fedora
openEuler
rdiff-backup
python-pyinstaller
python-pyinstaller-debuginfo
python-pyinstaller-debugsource
python-pyinstaller-help
python3-pyinstaller

Install updates from vendor's website.

pyinstaller - update to 5.13.1
Intel In-Band Manageability - update to 4.2.0
rdiff-backup - addressed in versions 2.2.6-3.el8, 2.2.6-3.el9, 2.2.6-3.fc38, 2.2.6-3.fc39
python-pyinstaller - update to 5.13.0-2
python-pyinstaller-debuginfo - update to 5.13.0-2
python-pyinstaller-debugsource - update to 5.13.0-2
python-pyinstaller-help - update to 5.13.0-2
python3-pyinstaller - update to 5.13.0-2

• https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5
• https://github.com/pyinstaller/pyinstaller/pull/7827
• https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623
• https://www.zerodayinitiative.com/advisories/ZDI-24-1641/

• Insecure temporary directory in PyInstaller
• Fedora EPEL 8 update for rdiff-backup
• Fedora EPEL 9 update for rdiff-backup
• Fedora 38 update for rdiff-backup
• Fedora 39 update for rdiff-backup
• Multiple vulnerabilities in Intel In-Band Manageability Framework
• openEuler 24.03 LTS update for python-pyinstaller