Skip to content
Fencer Intel
high 7.1

CVE-2024-4030 json

tempfile.mkdtemp() may be readable and writeable by all users on Windows

published 2y ago modified 4mo ago also BIT-python-2024-4030 , EUVD-2024-32595

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.

If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.

This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

Patch / fix

  • bitnami python 3.12.4
  • Python Software Foundation CPython 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.4, 3.13.0b1
  • python311 Linux Micro 6.1 3.11.12-slfo.1.1_1.1
  • python311-core Linux Micro 6.1 3.11.12-slfo.1.1_1.1
  • python311 Linux Micro 6.0 3.11.11-1.1
  • python311-core Linux Micro 6.0 3.11.11-1.1
  • python312 SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 3.12.4-150600.3.3.1
  • python312-core SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 3.12.4-150600.3.3.1
  • python312-documentation openSUSE Leap 15.6 3.12.4-150600.3.3.1

suse advisories SUSE-SU-2025:20374-1SUSE-SU-2025:20154-1SUSE-SU-2024:2572-1

  • python315 openSUSE Tumbleweed 3.15.0~a1-1.1
  • python314 openSUSE Tumbleweed 3.14.0~a1-1.1
  • python310 openSUSE Tumbleweed 3.10.15-1.1
  • python311 openSUSE Tumbleweed 3.11.9-7.1
  • python38 openSUSE Tumbleweed 3.8.20-1.1
  • python39 openSUSE Tumbleweed 3.9.20-1.1
  • python312 openSUSE Tumbleweed 3.12.5-1.1
  • python313 openSUSE Tumbleweed 3.13.0~b3-1.1

opensuse advisories openSUSE-SU-2025:15713-1openSUSE-SU-2024:14434-1openSUSE-SU-2024:14345-1openSUSE-SU-2024:14346-1openSUSE-SU-2024:14340-1openSUSE-SU-2024:14331-1

Is CVE-2024-4030 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
OSV 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami python
<3.12.4
3.12.4

Affected products

  • Python Software Foundation CPython
  • python cpython

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.