Execution with Unnecessary Privileges Affecting pyinstaller package, versions [,5.13.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PYINSTALLER-5880434
- published 19 Nov 2023
- disclosed 26 Aug 2023
- credit Rok Mandeljc
Introduced: 26 Aug 2023
CVE-2023-49797 Open this link in a new tabHow to fix?
Upgrade pyinstaller to version 5.13.1 or higher.
Overview
pyinstaller is a package that bundles a Python application and all its dependencies into a single package
Affected versions of this package are vulnerable to Execution with Unnecessary Privileges. When the tempfile.mkdtemp function is used, it creates a temporary directory that should only be accessible by the creating user ID. However, on Windows systems, the 0o700 POSIX permissions mask has no effect, leading to potential security issues. An attacker with local access can interfere with the application by modifying the contents of the temporary directory if it is located in a system-wide location and the application is running in privileged mode with developer mode enabled.
This is only exploitable if the temporary directory base is relocated to a system-wide location (e.g., c:\temp) and developer mode is enabled on the system.