p PatchFirst

CVE-2023-49797

CVE-2023-49797 · Local Privilege Escalation in pyinstaller on Windows

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 8.8 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • pyinstaller

    Versions
    • < 5.13.1: Affected

    No fix published

  • pyinstaller PyPI

    Versions
    • 1.5
    • 1.5.1
    • 2.0
    • 2.1
    • 3.0
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.3
    • 3.3.1
    • 3.4
    • 3.5
    • 3.6
    • 4.0
    • 4.1
    • 4.10
    • 4.2
    • 4.3
    • 4.4
    • 4.5
    • 4.5.1
    • 4.6
    • 4.7
    • 4.8
    • 4.9
    • 5.0
    • 5.0.1
    • 5.1
    • 5.10.0
    • 5.10.1
    • 5.11.0
    • 5.12.0
    • 5.13.0
    • 5.2
    • 5.3
    • 5.4
    • 5.4.1
    • 5.5
    • 5.6
    • 5.6.1
    • 5.6.2
    • 5.7.0
    • 5.8.0
    • 5.9.0
    Affected ranges
    • ECOSYSTEM: < 5.13.1

    Update to 5.13.1

Original sources

Check your server →