CVE-2023-49797

一、漏洞信息
 漏洞编号：[CVE-2023-49797](https://nvd.nist.gov/vuln/detail/CVE-2023-49797)
 漏洞归属组件：[python-pyinstaller](https://gitee.com/src-openeuler/python-pyinstaller)
 漏洞归属的版本：3.6,5.10.1,5.13.0,6.4.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user s temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()` s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
 漏洞公开时间：2023-12-09 09:15:07
 漏洞创建时间：2023-12-09 01:33:17
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-49797
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://github.com/pyinstaller/pyinstaller/pull/7827 |  |
| security-advisories.github.com | https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5 |  |
| security-advisories.github.com | https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623 |  |
| security-advisories.github.com | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2K2XIQLEMZIKUQUOWNDYWTEWYQTKMAN7/ |  |
| security-advisories.github.com | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ISRWT34FAF23PUOLVZ7RVWBZMWPDR5U7/ |  |
| redhat_bugzilla | https://github.com/pyinstaller/pyinstaller/pull/7827 | https://bugzilla.redhat.com/show_bug.cgi?id=2253843 |
| redhat_bugzilla | https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5 | https://bugzilla.redhat.com/show_bug.cgi?id=2253843 |
| redhat_bugzilla | https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623 | https://bugzilla.redhat.com/show_bug.cgi?id=2253843 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-49797 |
| github_advisory | https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5 | https://github.com/advisories/GHSA-9w2p-rh8c-v9g5 |
| python-pyinstaller |  | https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5 |
| ZeroDay | https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5 | https://www.zerodayinitiative.com/advisories/ZDI-24-1641/ |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/pyinstaller/pyinstaller/pull/7827 |  | security-advisories.github.com |
|  |  | https://github.com/pyinstaller/pyinstaller/pull/7827 |  | redhat_bugzilla |
|  |  | https://github.com/pyinstaller/pyinstaller/pull/7827 |  | nvd |
|  |  | https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5 |  | nvd |
|  |  | https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user s temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()` s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(3.6):受影响
2.openEuler-22.03-LTS-SP4(3.6):受影响
3.openEuler-24.03-LTS(5.13.0):受影响
4.openEuler-24.03-LTS-Next(5.13.0):受影响
5.master(6.4.0):不受影响
6.openEuler-20.03-LTS-SP4:不受影响
7.openEuler-24.03-LTS-SP1(5.13.0):不受影响
8.openEuler-24.03-LTS-SP2(5.13.0):

修复是否涉及abi变化(是/否)：
  1.master(6.4.0):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3(3.6):否
4.openEuler-22.03-LTS-SP4(3.6):否
5.openEuler-24.03-LTS(5.13.0):否
6.openEuler-24.03-LTS-Next(5.13.0):否
7.openEuler-24.03-LTS-SP1(5.13.0):否
8.openEuler-24.03-LTS-SP2(5.13.0):

原因说明：
  1.openEuler-24.03-LTS(5.13.0):正常修复
2.openEuler-24.03-LTS-Next(5.13.0):正常修复
3.openEuler-22.03-LTS-SP3(3.6):暂不修复-待升级版本修复
4.openEuler-22.03-LTS-SP4(3.6):暂不修复-待升级版本修复
5.openEuler-20.03-LTS-SP4:不受影响-组件不存在
6.master(6.4.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(5.13.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2(5.13.0):

src-openEuler/python-pyinstaller

内容风险标识

评论 (11)

src-openEuler/python-pyinstaller .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-49797

评论 (11)

搜索帮助

src-openEuler/python-pyinstaller