PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller
    built application, elevated as a privileged process, may be tricked by an unprivileged attacker into
    deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the
    following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2.
    The application is ran as administrator (or at least a user with higher privileges than the attacker). 3.
    The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP`
    environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The
    attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch
    must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The
    application was built with Python 3.7.x or earlier which has no protection against Directory Junctions
    links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`.
    Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-49797)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3909a0ab0e advisory.

    Rebuild for pyinstall CVE-2023-49797 BZ2253844

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0fb94a1209 advisory.

    Rebuild for pyinstall CVE-2023-49797 BZ2253844

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
413490	SCA: security update for pyinstaller (GHSA-9w2p-rh8c-v9g5)	Tenable Cloud Security	SCA Checks	high
413490	SCA: security update for pyinstaller (GHSA-9w2p-rh8c-v9g5)	Tenable Self-Hosted Container Security	SCA Checks	high
187067	Fedora 39 : rdiff-backup (2023-3909a0ab0e)	Nessus	Fedora Local Security Checks	high
187065	Fedora 38 : rdiff-backup (2023-0fb94a1209)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-49797

high

Tenable Plugins

high

high

high

high