CVE-2023-6507
Published: 8 December 2023
An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).
Notes
| Author | Note |
|---|---|
| mdeslaur | only affects 3.12.0, no earlier releases |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
python2.7 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
|
| focal |
Not vulnerable
|
|
| jammy |
Not vulnerable
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Not vulnerable
|
|
| upstream |
Not vulnerable
(debian: Vulnerable code not present)
|
|
| xenial |
Not vulnerable
|
|
|
python3.10 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
| focal |
Does not exist
|
|
| jammy |
Not vulnerable
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Not vulnerable
(debian: Vulnerable code not present)
|
|
| xenial |
Ignored
(end of standard support)
|
|
|
python3.11 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
| focal |
Does not exist
|
|
| jammy |
Not vulnerable
|
|
| lunar |
Not vulnerable
|
|
| mantic |
Not vulnerable
|
|
| noble |
Does not exist
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Not vulnerable
(debian: Vulnerable code not present)
|
|
| xenial |
Ignored
(end of standard support)
|
|
|
python3.12 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Needed
|
|
| noble |
Not vulnerable
(3.12.1-2)
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Released
(3.12.1-1)
|
|
| xenial |
Ignored
(end of standard support)
|
|
|
Patches: upstream: https://github.com/python/cpython/pull/112617 |
||
|
python3.7 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Not vulnerable
(debian: Vulnerable code not present)
|
|
| xenial |
Ignored
(end of standard support)
|
|
|
python3.9 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
| focal |
Not vulnerable
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Not vulnerable
(debian: Vulnerable code not present)
|
|
| xenial |
Ignored
(end of standard support)
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 4.9 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |