CVE-2024-4030
highPriorität · verfolgen · 0OT-Risiko · erhöhtEPSS 0.003 · 22. PerzentilDEEUNLRUUSEPSS · bewertet 2026-10-23
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.5–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (15)
Betroffene Produkte und Versionsbereiche.
- communications_unified_assurancealle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_unified_assurance:6.0.0-6.0.5:*:*:*:*:*:*:*
- peoplesoft_enterprise_peopletoolsalle Versionenncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*
- peoplesoft_enterprise_peopletoolsalle Versionenncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*
Advisories (6)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2025-0020Kwetsbaarheden verholpen in Oracle Database productenNL2025-01-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse database producten en subsystemen, zoals de Core Database, Graal, Application Express, GoldenGate en REST data.
- NCSC-2025-0021Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communicatieproducten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Network Function en Oracle Communications Order and Service Management.
- NCSC-2025-0023Kwetsbaarheden verholpen in Oracle PeopleSoftNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle PeopleSoft, specifiek in de versies 8.60, 8.61 en 9.2.
- WID-SEC-W-2025-2448NetApp ActiveIQ Unified Manager: Schwachstelle ermöglicht Manipulation von Dateien und Offenlegung von InformationenDeutsch2025-10-29csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in NetApp ActiveIQ Unified Manager ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.
- BIT-python-2024-40302024-05-14vendor · osvUS
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.
- PSF-2024-32024-05-07vendor · osvUS
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202405-1639cnnvd
- EUVD-2024-32595enisa_euvd
- BDU:2024-08617fstec_bdu
- GHSA-2w87-6hh6-mqrjenisa_euvd
- BIT-python-2024-4030osv
- PSF-2024-3osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (47)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2024-4030/cnnvd
- https://github.com/python/cpython/commit/35c799d79177b962ddace2fa068101465570a29acnnvd
- https://github.com/python/cpython/commit/5130731c9e779b97d00a24f54cdce73ce9975dfdcnnvd
- https://github.com/python/cpython/commit/66f8bb76a15e64a1bb7688b177ed29e26230fdeecnnvd
- https://github.com/python/cpython/commit/6d0850c4c8188035643586ab4d8ec2468abd699ecnnvd
- https://github.com/python/cpython/commit/81939dad77001556c527485d31a2d0f4a759033ecnnvd
- https://github.com/python/cpython/commit/8ed546679524140d8282175411fd141fe7df070dcnnvd
- https://github.com/python/cpython/commit/91e3669e01245185569d09e9e6e11641282971eecnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan