CVE-2023-49797: 
Python vulnerability analysis and mitigation

PyInstaller, a tool that bundles Python applications and their dependencies into a single package, was found to contain a local privilege escalation vulnerability (CVE-2023-49797) in versions prior to 5.13.1. The vulnerability was discovered and disclosed in December 2023, affecting applications built with PyInstaller that contain either matplotlib or win32com components (GitHub Advisory).

The vulnerability occurs when a PyInstaller-built application runs with elevated privileges and uses insecure temporary directory handling. The issue specifically manifests when the user's temporary directory is not locked to that specific user (usually due to TMP/TEMP environment variables pointing to an unprotected, arbitrary, non-default location). The vulnerability can be exploited through two methods: either by precisely timing the replacement of a temporary file with a symlink between shutil.rmtree()'s builtin symlink check and the deletion itself, or by exploiting applications built with Python 3.7.x or earlier which lacks protection against Directory Junctions links. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (High) (GitHub Advisory).

When successfully exploited, this vulnerability allows an unprivileged attacker to trick a privileged process into deleting files that the unprivileged user would not normally have access to. This creates a significant security risk for applications running with elevated privileges (GitHub Advisory).

The vulnerability has been patched in PyInstaller version 5.13.1 through PR #7827. Users are strongly advised to upgrade to this version or later. There are no known workarounds for this vulnerability, although the attack complexity becomes significantly higher if the application is built with Python >= 3.8.0 (GitHub Advisory).

The vulnerability has prompted responses from various Linux distributions, with Fedora issuing security updates for affected packages. For example, rdiff-backup was rebuilt in Fedora 38 and 39 to address this vulnerability (Fedora Update).