Creation of Temporary File With Insecure Permissions in Python - CVE-2024-4030

Vulnerability identifier: #VU96944

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-4030

CWE-ID: CWE-378

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users instead usually inheriting the correct permissions from the default location. A local user can gain access to potentially sensitive information stored in temporary files.

Successful exploitation of the vulnerability requires that an alternate configuration or users without a profile directory.

Python
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Micro
Python 3 Module
openSUSE Leap
Fedora
python3.8
python3.9
python3.10
python311
python311-curses
python311-debuginfo
python311-base-debuginfo
python311-debugsource
libpython3_11-1_0
python311-core-debugsource
libpython3_11-1_0-debuginfo
python311-base
python311-curses-debuginfo
libpython3_12-1_0-32bit-debuginfo
libpython3_12-1_0-64bit
python312-64bit-debuginfo
python312-64bit
python312-base-64bit
libpython3_12-1_0-64bit-debuginfo
python312-base-64bit-debuginfo
python312-doc
libpython3_12-1_0-debuginfo
python312-base
python312-idle
python312-tools
python312-dbm
python312-debuginfo
python312
python312-devel
python312-testsuite
libpython3_12-1_0
python312-testsuite-debuginfo
python312-debugsource
python312-dbm-debuginfo
python312-tk
python312-curses
python312-core-debugsource
python312-curses-debuginfo
python312-base-debuginfo
python312-doc-devhelp
python312-tk-debuginfo
libpython3_12-1_0-32bit
python312-32bit
python312-32bit-debuginfo
python312-base-32bit-debuginfo
python312-base-32bit

Install updates from vendor's website.

Python - addressed in versions 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.6
python3.8 - addressed in versions 3.8.20-1.fc39, 3.8.20-1.fc40, 3.8.20-1.fc41
python3.9 - addressed in versions 3.9.20-1.fc39, 3.9.20-1.fc40, 3.9.20-1.fc41
python3.10 - addressed in versions 3.10.15-1.fc39, 3.10.15-1.fc40, 3.10.15-1.fc41
python311 - update to 3.11.12-slfo.1.1_1.1
python311-curses - update to 3.11.12-slfo.1.1_1.1
python311-debuginfo - update to 3.11.12-slfo.1.1_1.1
python311-base-debuginfo - update to 3.11.12-slfo.1.1_1.1
python311-debugsource - update to 3.11.12-slfo.1.1_1.1
libpython3_11-1_0 - update to 3.11.12-slfo.1.1_1.1
python311-core-debugsource - update to 3.11.12-slfo.1.1_1.1
libpython3_11-1_0-debuginfo - update to 3.11.12-slfo.1.1_1.1
python311-base - update to 3.11.12-slfo.1.1_1.1
python311-curses-debuginfo - update to 3.11.12-slfo.1.1_1.1
libpython3_12-1_0-32bit-debuginfo - update to 3.12.4-150600.3.3.1
libpython3_12-1_0-64bit - update to 3.12.4-150600.3.3.1
python312-64bit-debuginfo - update to 3.12.4-150600.3.3.1
python312-64bit - update to 3.12.4-150600.3.3.1
python312-base-64bit - update to 3.12.4-150600.3.3.1
libpython3_12-1_0-64bit-debuginfo - update to 3.12.4-150600.3.3.1
python312-base-64bit-debuginfo - update to 3.12.4-150600.3.3.1
python312-doc - update to 3.12.4-150600.3.3.1
libpython3_12-1_0-debuginfo - update to 3.12.4-150600.3.3.1
python312-base - update to 3.12.4-150600.3.3.1
python312-idle - update to 3.12.4-150600.3.3.1
python312-tools - update to 3.12.4-150600.3.3.1
python312-dbm - update to 3.12.4-150600.3.3.1
python312-debuginfo - update to 3.12.4-150600.3.3.1
python312 - update to 3.12.4-150600.3.3.1
python312-devel - update to 3.12.4-150600.3.3.1
python312-testsuite - update to 3.12.4-150600.3.3.1
libpython3_12-1_0 - update to 3.12.4-150600.3.3.1
python312-testsuite-debuginfo - update to 3.12.4-150600.3.3.1
python312-debugsource - update to 3.12.4-150600.3.3.1
python312-dbm-debuginfo - update to 3.12.4-150600.3.3.1
python312-tk - update to 3.12.4-150600.3.3.1
python312-curses - update to 3.12.4-150600.3.3.1
python312-core-debugsource - update to 3.12.4-150600.3.3.1
python312-curses-debuginfo - update to 3.12.4-150600.3.3.1
python312-base-debuginfo - update to 3.12.4-150600.3.3.1
python312-doc-devhelp - update to 3.12.4-150600.3.3.1
python312-tk-debuginfo - update to 3.12.4-150600.3.3.1
libpython3_12-1_0-32bit - update to 3.12.4-150600.3.3.1
python312-32bit - update to 3.12.4-150600.3.3.1
python312-32bit-debuginfo - update to 3.12.4-150600.3.3.1
python312-base-32bit-debuginfo - update to 3.12.4-150600.3.3.1
python312-base-32bit - update to 3.12.4-150600.3.3.1

• https://mail.python.org/archives/list/security-announce@python.org/thread/PRGS5OR3N3PNPT4BMV2VAGN5GMUI5636/
• https://github.com/python/cpython/issues/118486
• https://github.com/python/cpython/commit/81939dad77001556c527485d31a2d0f4a759033e
• https://github.com/python/cpython/commit/8ed546679524140d8282175411fd141fe7df070d
• https://github.com/python/cpython/commit/35c799d79177b962ddace2fa068101465570a29a
• https://github.com/python/cpython/commit/5130731c9e779b97d00a24f54cdce73ce9975dfd
• https://github.com/python/cpython/commit/66f8bb76a15e64a1bb7688b177ed29e26230fdee
• https://github.com/python/cpython/commit/6d0850c4c8188035643586ab4d8ec2468abd699e
• https://github.com/python/cpython/commit/91e3669e01245185569d09e9e6e11641282971ee
• https://github.com/python/cpython/commit/94591dca510c796c7d40e9b4167ea56f2fdf28ca
• https://github.com/python/cpython/commit/c8f868dc52f98011d0f9b459b6487920bfb0ac4d
• https://github.com/python/cpython/commit/d86b49411753bf2c83291e3a14ae43fefded2f84
• https://github.com/python/cpython/commit/e1dfa978b1ad210d551385ad8073ec6154f53763
• https://github.com/python/cpython/commit/eb29e2f5905da93333d1ce78bc98b151e763ff46

• SUSE update for python312
• Insecure temporary file in Python for Windows
• Fedora 41 update for python3.10
• Fedora 40 update for python3.10
• Fedora 39 update for python3.10
• Fedora 41 update for python3.9
• Fedora 40 update for python3.9
• Fedora 39 update for python3.9
• Fedora 39 update for python3.8
• Fedora 41 update for python3.8
• Fedora 40 update for python3.8
• SUSE update for python311