CVE-2023-49797: Local Privilege Escalation in Windows
(updated )
A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to.
A user is affected if all the following are satisfied:
References
- github.com/advisories/GHSA-9w2p-rh8c-v9g5
- github.com/pyinstaller/pyinstaller
- github.com/pyinstaller/pyinstaller/pull/7827
- github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5
- github.com/pypa/advisory-database/tree/main/vulns/pyinstaller/PYSEC-2023-292.yaml
- github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2K2XIQLEMZIKUQUOWNDYWTEWYQTKMAN7
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ISRWT34FAF23PUOLVZ7RVWBZMWPDR5U7
- nvd.nist.gov/vuln/detail/CVE-2023-49797
Code Behaviors & Features
Detect and mitigate CVE-2023-49797 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →