CVE-2024-4030: Insufficient Information (NVD-CWE-noinfo)
value: On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.

If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.

This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-07T21:15Z
Repository: https://github.com/python/cpython
Language: Other
Files changed: Doc/whatsnew/3.13.rst, Misc/NEWS.d/next/Security/2024-05-01-20-57-09.gh-issue-118486.K44KJG.rst
Commit date: 2024-05-08 15:52:39 +0000
Commit message: gh-118486: Update docs for CVE-2024-4030 reference (GH-118737)


Diff: diff --git a/Doc/whatsnew/3.13.rst b/Doc/whatsnew/3.13.rst
index 69264a3672bb..8e90faee667d 100644
--- a/Doc/whatsnew/3.13.rst
+++ b/Doc/whatsnew/3.13.rst
@@ -845,10 +845,16 @@ os
 * :func:`os.posix_spawn` gains an :attr:`os.POSIX_SPAWN_CLOSEFROM` attribute for
   use in ``file_actions=`` on platforms that support
   :c:func:`!posix_spawn_file_actions_addclosefrom_np`.
   (Contributed by Jakub Kulik in :gh:`113117`.)
 
+* :func:`os.mkdir` and :func:`os.makedirs` on Windows now support passing a
+  *mode* value of ``0o700`` to apply access control to the new directory. This
+  implicitly affects :func:`tempfile.mkdtemp` and is a mitigation for
+  :cve:`2024-4030`. Other values for *mode* continue to be ignored.
+  (Contributed by Steve Dower in :gh:`118486`.)
+
 os.path
 -------
 
 * Add :func:`os.path.isreserved` to check if a path is reserved on the current
   system. This function is only available on Windows.
@@ -987,10 +993,18 @@ sys
 
 * Add the :func:`sys._is_interned` function to test if the string was interned.
   This function is not guaranteed to exist in all implementations of Python.
   (Contributed by Serhiy Storchaka in :gh:`78573`.)
 
+tempfile
+--------
+
+* On Windows, the default mode ``0o700`` used by :func:`tempfile.mkdtemp` now
+  limits access to the new directory due to changes to :func:`os.mkdir`. This
+  is a mitigation for :cve:`2024-4030`.
+  (Contributed by Steve Dower in :gh:`118486`.)
+
 time
 ----
 
 * On Windows, :func:`time.monotonic()` now uses the
   ``QueryPerformanceCounter()`` clock to have a resolution better than 1 us,
diff --git a/Misc/NEWS.d/next/Security/2024-05-01-20-57-09.gh-issue-118486.K44KJG.rst b/Misc/NEWS.d/next/Security/2024-05-01-20-57-09.gh-issue-118486.K44KJG.rst
new file mode 100644
index 000000000000..8ac48aac816a
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2024-05-01-20-57-09.gh-issue-118486.K44KJG.rst
@@ -0,0 +1,4 @@
+:func:`os.mkdir` on Windows now accepts *mode* of ``0o700`` to restrict
+the new directory to the current user. This fixes :cve:`2024-4030`
+affecting :func:`tempfile.mkdtemp` in scenarios where the base temporary
+directory is more permissive than the default.

Fixed code: * :func:`os.mkdir` and :func:`os.makedirs` on Windows now support passing a
  *mode* value of ``0o700`` to apply access control to the new directory. This
  implicitly affects :func:`tempfile.mkdtemp` and is a mitigation for
  :cve:`2024-4030`. Other values for *mode* continue to be ignored.
  (Contributed by Steve Dower in :gh:`118486`.)

tempfile
--------

* On Windows, the default mode ``0o700`` used by :func:`tempfile.mkdtemp` now
  limits access to the new directory due to changes to :func:`os.mkdir`. This
  is a mitigation for :cve:`2024-4030`.
  (Contributed by Steve Dower in :gh:`118486`.)

:func:`os.mkdir` on Windows now accepts *mode* of ``0o700`` to restrict
the new directory to the current user. This fixes :cve:`2024-4030`
affecting :func:`tempfile.mkdtemp` in scenarios where the base temporary
directory is more permissive than the default.