We have updated the patch for this issue, in order to simplify the fix
and properly support non-English Windows.
The patch for 3.12.4 has been applied at
https://github.com/python/cpython/commit/eb29e2f5905da93333d1ce78bc98b151e763ff46
This is the cleanest patch, as it does not involve the earlier changes.
The update to the main and 3.13 branches are at
https://github.com/python/cpython/commit/8af84b503d0b62a3db0d806d39f42c1e08746079
and
https://github.com/python/cpython/commit/9d646d084c6fec83bed7bfa72d83b2ae3cf09644,
respectively. This update will be released in 3.13.0b2.
Earlier versions of Python will be merged before their next source-only
releases. All pull requests are linked from
https://github.com/python/cpython/issues/118486
On 07/05/2024 21:57, Seth Larson wrote:
On Windows a directory returned by tempfile.mkdtemp()would not always
have permissions set to restrict reading and writing to the temporary
directory by other users, instead usually inheriting the correct
permissions from the default location. Alternate configurations or users
without a profile directory may not have the intended permissions.
If you’re not using Windows or haven’t changed the temporary directory
location then you aren’t affected by this vulnerability. On other
platforms the returned directory is consistently readable and writable
only by the current user.
This issue was caused by Python not supporting Unix permissions on
Windows. The fix adds support for Unix “700” for the mkdirfunction on
Windows which is used by mkdtemp()to ensure the newly created directory
has the proper permissions.
The fix will be made available in CPython versions 3.13.0b1 and 3.12.4.
Backports are pending for other security release streams.
Severity: Medium
Issue: https://github.com/python/cpython/issues/118486
<https://github.com/python/cpython/issues/118486>
Patch:
https://github.com/python/cpython/commit/81939dad77001556c527485d31a2d0f4a759033e <https://github.com/python/cpython/commit/81939dad77001556c527485d31a2d0f4a759033e>
Patch:
https://github.com/python/cpython/commit/8ed546679524140d8282175411fd141fe7df070d <https://github.com/python/cpython/commit/8ed546679524140d8282175411fd141fe7df070d>
_______________________________________________
Security-announce mailing list -- security-annou...@python.org
To unsubscribe send an email to security-announce-le...@python.org
https://mail.python.org/mailman3/lists/security-announce.python.org/
Member address: steve.do...@python.org
_______________________________________________
Security-announce mailing list -- security-annou...@python.org
To unsubscribe send an email to security-announce-le...@python.org
https://mail.python.org/mailman3/lists/security-announce.python.org/
Member address: arch...@mail-archive.com
