7.1

CVE-2024-4030: python software foundation cpython Incorrect Default Permissions

CVSS: 7.1v3.1HighDeferred
AliasesCGA-2vj6-9jh9-57q6CGA-5hw4-rhmp-4rwqCGA-6376-fw76-9xff
Published 07-05-2024Last modified 07-09-2024
Open JSON

Vulnerability summary

CVE-2024-4030 is a high (CVSS 7.1) Incorrect Default Permissions vulnerability in python software foundation cpython. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.2% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 17
OPENSUSE-SU-2024:14109-1OPENSUSE-SU-2024:14295-1OPENSUSE-SU-2024:14340-1OPENSUSE-SU-2024:14345-1OPENSUSE-SU-2024:14346-1OPENSUSE-SU-2024:14434-1

Timeline

  1. 07-05-2024
    PublishedVulnerability first disclosed.
  2. 07-09-2024
    Last modifiedVulnerability information updated.

Description

On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

0.00 pp

From 0.30% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard5 products
  • aws-cli-v2All versions (No fix recorded)
  • python-3.10All versions (No fix recorded)
  • python-3.11All versions (No fix recorded)
  • python-3.12All versions (No fix recorded)
  • python-3.9All versions (No fix recorded)
Wolfi4 products
  • aws-cli-v2All versions (No fix recorded)
  • python-3.10All versions (No fix recorded)
  • python-3.11All versions (No fix recorded)
  • python-3.12All versions (No fix recorded)
Opensuse1 product
  • python39&distro=openSUSE Tumbleweed< 3.9.20-1.1
Python software foundation1 product
  • cpython< 3.8.20 | ≥ 3.9.0, < 3.9.20 | ≥ 3.10.0, < 3.10.15 | ≥ 3.11.0, < 3.11.10 | ≥ 3.12.0, < 3.12.4 | ≥ 3.13.0a1, < 3.13.0b1

4 vendors · 11 products

References

19 links
Show all 19 references