Skip to content
Fencer Vulns
high 7.1

CVE-2024-4030 json

tempfile.mkdtemp() may be readable and writeable by all users on Windows

published 2024-05-07 2 y ago modified 2026-06-17 4 mo ago also BIT-python-2024-4030 , EUVD-2024-32595

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.

If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.

This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

Patch / fix

  • bitnami python 3.12.4
  • Python Software Foundation CPython 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.4, 3.13.0b1
  • python311 Linux Micro 6.1 3.11.12-slfo.1.1_1.1
  • python311-core Linux Micro 6.1 3.11.12-slfo.1.1_1.1
  • python311 Linux Micro 6.0 3.11.11-1.1
  • python311-core Linux Micro 6.0 3.11.11-1.1
  • python312 SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 3.12.4-150600.3.3.1
  • python312-core SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 3.12.4-150600.3.3.1
  • python312-documentation openSUSE Leap 15.6 3.12.4-150600.3.3.1

suse advisories SUSE-SU-2025:20374-1SUSE-SU-2025:20154-1SUSE-SU-2024:2572-1

  • python315 openSUSE Tumbleweed 3.15.0~a1-1.1
  • python314 openSUSE Tumbleweed 3.14.0~a1-1.1
  • python310 openSUSE Tumbleweed 3.10.15-1.1
  • python311 openSUSE Tumbleweed 3.11.9-7.1
  • python38 openSUSE Tumbleweed 3.8.20-1.1
  • python39 openSUSE Tumbleweed 3.9.20-1.1
  • python312 openSUSE Tumbleweed 3.12.5-1.1
  • python313 openSUSE Tumbleweed 3.13.0~b3-1.1

opensuse advisories openSUSE-SU-2025:15713-1openSUSE-SU-2024:14434-1openSUSE-SU-2024:14345-1openSUSE-SU-2024:14346-1openSUSE-SU-2024:14340-1openSUSE-SU-2024:14331-1

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
OSV 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami python
<3.12.4
3.12.4

Affected products

  • Python Software Foundation CPython
  • python cpython

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.