CVE-2019-16784: PyInstaller Local Privilege Escalation Vulnerability

Q: What is CVE-2019-16784?

CVE-2019-16784 is a security vulnerability in PyInstaller involving Local Privilege Escalation in PyInstaller under CWE-250: Execution with Unnecessary Privileges.

Q: Which PyInstaller versions are affected?

Affected versions include releases prior to 3.6 across affected packages: PyInstaller.

Q: What version fixes CVE-2019-16784?

Upgrading to 3.6 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is PyInstaller affected?

Yes, PyInstaller is affected in releases prior to 3.6. Upgrade your dependency to 3.6 or later.

Q: What is the CVSS score of CVE-2019-16784?

CVE-2019-16784 has a CVSS v3.1 base score of 7.0 (HIGH) with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Q: What CWE is associated with CVE-2019-16784?

CVE-2019-16784 is classified under CWE-250: Execution with Unnecessary Privileges (The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.).

Q: How can I check PyPI dependencies for CVE-2019-16784?

Run the dependency tree command: 'pip show PyInstaller'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-7fcj-pq9j-wh2r

CVSS 7.0

CWE-250

Published 2020-01-16

Advisory Summary

CVE-2019-16784 is a HIGH (CVSS 7.0) local privilege escalation vulnerability (CWE-250: Execution with Unnecessary Privileges) affecting PyInstaller libraries in the PyPI ecosystem. The issue involves local privilege escalation in pyinstaller. Remediation is available by upgrading affected packages to version 3.6.

CVE-2019-16784 at a Glance

CVE Identifier CVE-2019-16784

GHSA Identifier GHSA-7fcj-pq9j-wh2r

Severity HIGH

CVSS v3.1 Base Score 7.0

CWE Classification CWE-250: Execution with Unnecessary Privileges

Affected Product PyInstaller

Package Ecosystem PyPI

Published Date 2020-01-16

Last Updated 2024-10-23

Security Impact

CVSS: 7.0

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)

Attack Complexity High (AC:H)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2019-16784

To remediate this vulnerability, upgrade all affected PyInstaller dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

PyInstaller fixed: 3.6

pip install PyInstaller>=3.6

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show PyInstaller

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2019-16784, inspect your installed packages using pip:

pip show PyInstaller

Analyze the terminal output to locate any version of PyInstaller in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.6), your application is affected.

Note: The pip show PyInstaller command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-250: Execution with Unnecessary Privileges, where the product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. In PyInstaller, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Local Privilege Escalation in all Windows software frozen by PyInstaller in "onefile" mode. The vulnerability is present only on Windows and in this particular case: If a **software frozen by PyInstaller in "onefile" mode** is launched by a (privileged) user who has **his/her "TempPath" resolving to a world writable directory**. This is the case e.g. if the software is launched as a service or as a scheduled task using a system account (in which case TempPath will default to C:\Windows\Temp). In order to be exploitable the software has to be (re)started after the attacker has launched the exploit program. So for a service launched at startup, a service restart is needed (e.g. after a crash or an upgrade). While PyInstaller itself was not vulnerable, all Windows software frozen by PyInstaller in "onefile" mode is vulnerable. CVSSv3 score 7.0 (High) CVSSv3 vector CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected - all Windows software frozen by PyInstaller in "onefile" mode No affected - PyInstaller itself (except if frozen by PyInstaller in "onefile" mode on Windows) - software frozen in "one*dir*" mode - other platforms (GNU/Linux, OS X, BSD, etc.) ### Patches The problem is patched in commits 42a67148b3bdf9211fda8499fdc5b63acdd7e6cc (fixed code) and be948cf0954707671aa499da17b10c86b6fa5e5c (recompiled bootloaders). Users should upgrade to PyInstaller version 3.6 and rebuild their software. ### Workarounds There is no known workaround. Users using PyInstaller to freeze their Windows software using "onefile" mode should upgrade PyInstaller and rebuild their software. ### Credits This vulnerability was discovered and reported by Farid AYOUJIL (@faridtsl), David HA, Florent LE NIGER and Yann GASCUEL (@lnv42) from Alter Solutions (@AlterSolutions) and fixed in collaboration with Hartmut Goebel (@htgoebel, maintainer of PyInstaller). ### Funding Development PyInstaller is in urgent need of funding to make future security fixes happen, see <https://github.com/pyinstaller/pyinstaller/issues/4404> for details.

CVE-2019-16784 Affected PyInstaller Versions

1 component(s)

Fixed Versions:

3.6

Product / Package	Ecosystem	Affected Versions	Fixed Version
PyInstaller pypi/PyInstaller	PyPI	< 3.6	3.6

References

GitHub Advisory / Wiki ADVISORY

https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-7fcj-pq9j-wh2r

NVD — CVE-2019-16784 NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-16784

Security Fix Commit FIX COMMIT

https://github.com/pyinstaller/pyinstaller/commit/42a67148b3bdf9211fda8499fdc5b63acdd7e6cc

Security Fix Commit FIX COMMIT

https://github.com/pyinstaller/pyinstaller/commit/be948cf0954707671aa499da17b10c86b6fa5e5c

PyInstaller Source Repository REPOSITORY

https://github.com/pyinstaller/pyinstaller

PyInstaller Source Repository REPOSITORY

https://github.com/pypa/advisory-database/tree/main/vulns/pyinstaller/PYSEC-2020-175.yaml

Frequently Asked Questions

What is CVE-2019-16784?

CVE-2019-16784 is a security vulnerability in PyInstaller involving Local Privilege Escalation in PyInstaller under CWE-250: Execution with Unnecessary Privileges.

Which PyInstaller versions are affected?

Affected versions include releases prior to 3.6 across affected packages: PyInstaller.

What version fixes CVE-2019-16784?

Upgrading to 3.6 (or the latest patched release for your respective branch) resolves the vulnerability.

Is PyInstaller affected?

Yes, PyInstaller is affected in releases prior to 3.6. Upgrade your dependency to 3.6 or later.

What is the CVSS score of CVE-2019-16784?

CVE-2019-16784 has a CVSS v3.1 base score of 7.0 (HIGH) with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2019-16784?

CVE-2019-16784 is classified under CWE-250: Execution with Unnecessary Privileges (The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.).

How can I check PyPI dependencies for CVE-2019-16784?

Run the dependency tree command: 'pip show PyInstaller'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7fcj-pq9j-wh2r",
  "modified" : "2024-10-23T15:54:56Z",
  "published" : "2020-01-16T22:18:27Z",
  "aliases" : [ "CVE-2019-16784" ],
  "summary" : "Local Privilege Escalation in PyInstaller",
  "details" : "### Impact\n\nLocal Privilege Escalation in all Windows software frozen by PyInstaller in \"onefile\" mode.\n\nThe vulnerability is present only on Windows and in this particular case: If a **software frozen by PyInstaller in \"onefile\" mode** is launched by a (privileged) user who has **his/her \"TempPath\" resolving to a world writable directory**. This is the case e.g. if the software is launched as a service or as a scheduled task using a system account (in which case TempPath will default to C:\\Windows\\Temp).\n\nIn order to be exploitable the software has to be (re)started after the attacker has launched the exploit program. So for a service launched at startup, a service restart is needed (e.g. after a crash or an upgrade).\n\nWhile PyInstaller itself was not vulnerable, all Windows software frozen by PyInstaller in \"onefile\" mode is vulnerable.\n\nCVSSv3 score 7.0 (High)\nCVSSv3 vector CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nAffected\n- all Windows software frozen by PyInstaller in \"onefile\" mode\n\nNo affected\n- PyInstaller itself (except if frozen by PyInstaller in \"onefile\" mode on Windows)\n- software frozen in \"one*dir*\" mode\n- other platforms (GNU/Linux, OS X, BSD, etc.)\n\n### Patches\nThe problem is patched in commits 42a67148b3bdf9211fda8499fdc5b63acdd7e6cc (fixed code) and be948cf0954707671aa499da17b10c86b6fa5e5c (recompiled bootloaders). Users should upgrade to PyInstaller version 3.6 and rebuild their software.\n\n### Workarounds\nThere is no known workaround. Users using PyInstaller to freeze their Windows software using \"onefile\" mode should upgrade PyInstaller and rebuild their software.\n\n### Credits\nThis vulnerability was discovered and reported by Farid AYOUJIL (@faridtsl), David HA, Florent LE NIGER and Yann GASCUEL (@lnv42) from Alter Solutions (@AlterSolutions) and fixed in collaboration with\nHartmut Goebel (@htgoebel, maintainer of PyInstaller).\n\n### Funding Development\n\nPyInstaller is in urgent need of funding to make future security fixes happen, see <https://github.com/pyinstaller/pyinstaller/issues/4404> for details.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "PyInstaller"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-7fcj-pq9j-wh2r"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2019-16784"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pyinstaller/pyinstaller/commit/42a67148b3bdf9211fda8499fdc5b63acdd7e6cc"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pyinstaller/pyinstaller/commit/be948cf0954707671aa499da17b10c86b6fa5e5c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pyinstaller/pyinstaller"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/pyinstaller/PYSEC-2020-175.yaml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-250" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-01-14T20:09:51Z",
    "nvd_published_at" : null
  }
}

CVSS V3

7.0 HIGH