Groups not dropped before running subprocess when using empty 'extra_groups' parameter
Key facts
- Attack vector
- Adjacent network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Software Foundation | CPython | before 3.12.1; 3.13.0a1 to before 3.13.0a3 | 3.12.1, 3.13.0a3 | Patch available | CNA |
- CPython VendorPython Software Foundation Affected before 3.12.1; 3.13.0a1 to before 3.13.0a3 Fixed in 3.12.1, 3.13.0a3 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:3.12.0:-:*:*:*:*:*:* | 3.12.0 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.13.0:alpha1:*:*:*:*:*:* | 3.13.0 alpha1 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.13.0:alpha2:*:*:*:*:*:* | 3.13.0 alpha2 | Vulnerable | python-pillow |
- cpe:2.3:a:python:python:3.12.0:-:*:*:*:*:*:* Versions 3.12.0 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.13.0:alpha1:*:*:*:*:*:* Versions 3.13.0 alpha1 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.13.0:alpha2:*:*:*:*:*:* Versions 3.13.0 alpha2 Vulnerable ·python-pillow
Remediation
- Fix · CNA CPython (Python Software Foundation) Fixed in 3.12.1, 3.13.0a3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6507
- 2026-10-03 Alias added: GHSA-4wxh-fpjf-c8wf
References
Patch 4
More Python Software Foundation vulnerabilities
- TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
- TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
- TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
- TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
- TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
- TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
Sources
- CVE-2023-6507 · CVE Program
- CVE-2023-6507 · NVD
- FIRST EPSS
- GHSA-4wxh-fpjf-c8wf · GitHub Advisory Database · CC BY 4.0
- CVE-2023-6507 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences