PYSEC-2023-292

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/pyinstaller/PYSEC-2023-292.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2023-292
Aliases
Published
2023-12-09T01:15:00Z
Modified
2024-11-21T14:59:29.419967Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either matplotlib or win32com. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to TMP/TEMP environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between shutil.rmtree()'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to pyinstaller >= 5.13.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

Affected packages

PyPI / pyinstaller

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.13.1

Affected versions

1.*

1.5
1.5.1

2.*

2.0
2.1

3.*

3.0
3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.4
3.5
3.6

4.*

4.0
4.1
4.2
4.3
4.4
4.5
4.5.1
4.6
4.7
4.8
4.9
4.10

5.*

5.0
5.0.1
5.1
5.2
5.3
5.4
5.4.1
5.5
5.6
5.6.1
5.6.2
5.7.0
5.8.0
5.9.0
5.10.0
5.10.1
5.11.0
5.12.0
5.13.0