CVE-2023-49797: Pyinstaller Local Privilege Escalation Vulnerability
HIGHCVE-2023-49797 is a HIGH (CVSS 8.8) local privilege escalation vulnerability (CWE-379: Creation of Temporary File in Directory with Insecure Permissions) affecting Pyinstaller libraries in the PyPI ecosystem. The issue involves local privilege escalation in windows. Remediation is available by upgrading affected packages to version 5.13.1.
CVE-2023-49797 at a Glance
Security Impact
CVSS: 8.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
How to Fix CVE-2023-49797
To remediate this vulnerability, upgrade all affected Pyinstaller dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install pyinstaller>=5.13.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show pyinstallerHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2023-49797, inspect your installed packages using pip:
pip show pyinstallerAnalyze the terminal output to locate any version of Pyinstaller in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.13.1), your application is affected.
Note: The pip show pyinstaller command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-379: Creation of Temporary File in Directory with Insecure Permissions, where the product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file. In Pyinstaller, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-49797 Affected Pyinstaller Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
pyinstaller
|
PyPI |
< 5.13.1
|
5.13.1
|
References
Frequently Asked Questions
What is CVE-2023-49797?
Which Pyinstaller versions are affected?
What version fixes CVE-2023-49797?
Is pyinstaller affected?
What is the CVSS score of CVE-2023-49797?
What CWE is associated with CVE-2023-49797?
How can I check PyPI dependencies for CVE-2023-49797?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-9w2p-rh8c-v9g5",
"modified" : "2024-11-22T20:21:21Z",
"published" : "2023-12-09T00:39:46Z",
"aliases" : [ "CVE-2023-49797" ],
"summary" : "Local Privilege Escalation in Windows",
"details" : "### Impact\n\nA PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to.\n\nA user is affected if **all** the following are satisfied:\n\n* The user runs an application containing either `matplotlib` or `win32com`.\n* The application is ran as administrator (or at least a user with higher privileges than the attacker).\n* The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location).\n* Either:\n - The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between [`shutil.rmtree()`'s builtin symlink check](https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623) and the deletion itself\n - The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links\n\n### Patches\n\nThe vulnerability has been addressed in https://github.com/pyinstaller/pyinstaller/pull/7827 which corresponds to `pyinstaller >= 5.13.1`\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nNo workaround, although the attack complexity becomes much higher if the application is built with Python >= 3.8.0.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "pyinstaller"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "5.13.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-49797"
}, {
"type" : "WEB",
"url" : "https://github.com/pyinstaller/pyinstaller/pull/7827"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/pyinstaller/pyinstaller"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/pyinstaller/PYSEC-2023-292.yaml"
}, {
"type" : "WEB",
"url" : "https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623"
}, {
"type" : "WEB",
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2K2XIQLEMZIKUQUOWNDYWTEWYQTKMAN7"
}, {
"type" : "WEB",
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ISRWT34FAF23PUOLVZ7RVWBZMWPDR5U7"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-379", "CWE-732" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-12-09T00:39:46Z",
"nvd_published_at" : "2023-12-09T01:15:07Z"
}
}