Skip to content
Appaloosa Scout
Language selector
fr en

Vulnerability · NVD

CVE-2023-6507

CVE-2023-6507, medium severity (CVSS 6.1): 3 tracked apps concerned, all fixed or indeterminable on their current version.

Severity (CVSS)
6.1

NVD scale

Exploitation
1.3 %

EPSS, predicted over 30 days

Tracked apps
3
Still exposed
0

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.

When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list.

This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).

Attack vector : Adjacent network No user interaction
Show raw CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS 1.34% above median percentile 70.0%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

  • Python 3.12 Windows winget:Python.Python.3.12
    Affected - Fixed in - Latest tracked 3.12.10 undetermined
  • Python 3.13 Windows winget:Python.Python.3.13
    Affected - Fixed in - Latest tracked 3.13.15 undetermined
  • Python 3.14 Windows winget:Python.Python.3.14
    Affected - Fixed in - Latest tracked 3.14.7 undetermined
Vulnerable CPE configurations (3)
Vendor Product Versions
python python
All platforms (wildcard)
 -
python python
All platforms (wildcard)
 -
python python
All platforms (wildcard)
 -
View on NVD ↗ Advisory · github.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM