Path traversal on tempfile.TemporaryDirectory
CVE: CVE-2023-6597
Component: python
CWE: CWE-61
Severity: Important
CVSS v3: 7.8/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link.

Statement: Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

You can download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha value for the release is:

(For x86_64 architecture)
The image digest is sha256:678a46017c31128166b20c11ae17bb17ab2c6cc4320a8c3ba552cc08f9430a9a

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:fb687ffbbe6fcb4b551518c5e910929bbac6baf5b5b1bbbc286fb2da9dbd5490

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:725dc741c44b151b8b39ee3b2c7bd8364f1082c39c313de6d0579df001069fdb

      (For s390x architecture)
      The image digest is sha256:335cf0afdb38321f745da3b15336c7f6ba5c13908022351ec9648f1e16aaf6e5

      (For ppc64le architecture)
      The image digest is sha256:5c2c6faeb9155a97935c1ec0e6f74c86f3a04022d1a242f02c62dc1f75fb1778

      (For aarch64 architecture)
      The image digest is sha256:3628e6a5b4321b577b347adaf539502e3d04d02ca4f95f4901f67aef60f2df70

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:a42b52fe6d1521debfab6aa72fdbce79b9077bb8fdc6392608d07f1f5dbed3cb

      (For s390x architecture)
      The image digest is sha256:e87f6b03f0810fe7bd5144d1368b67bae097704846ba5bcd8870cff45a32ffda

      (For ppc64le architecture)
      The image digest is sha256:6696e1de988f8f2e6b11c68545ec39086fe996a468f632c26098294f3a9f7754

      (For aarch64 architecture)
      The image digest is sha256:49a6d2b6dba439b2bb8cc356d790a4df371985f0f3fefa2a23bf519b3520e46a

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:0e71cb61694473b40e8d95f530eaf250a62616debb98199f31b4034808687dae

      (For s390x architecture)
      The image digest is sha256:9a9994d9b6b56faf3d158e479e87f15ede5783c7408433129547c917d1c90fcc

      (For ppc64le architecture)
      The image digest is sha256:cf6a70ea1b63cb49fca5aae3de7991d2c9321343943967f4653827f328ccef3a

      (For aarch64 architecture)
      The image digest is sha256:0a52bafb899c924f448612b7ca6bb96a9062cd80385d3f9aa567aebac97931e5

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:e0907823bc8989b02bb1bd55d5f08262dd0e4846173e792c14e7684fbd476c0d

      (For s390x architecture)
      The image digest is sha256:0ceb174ca670cfa3202ce15e1a884478bd4474c6bf2cf74fac0a44681bfbb8f3

      (For ppc64le architecture)
      The image digest is sha256:460da6202791b5d3ec0ddd71a577723ffc68e35cf728ebbef832ef0a3c42e7be

      (For aarch64 architecture)
      The image digest is sha256:4b48c890a1229bdb587fb4865fbebbb9f466e7e4a9bae0fbc7ec85352c5d6041

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:93879f84b3165c5b5bd1fdf4563a11155dc61ea35cd93e67dc61c2b66e11c8bb

      (For s390x architecture)
      The image digest is sha256:9c48f890dd798cf11b94d8b952ccc1fda209f7976d1e69bdf3485d7a65a8efda

      (For ppc64le architecture)
      The image digest is sha256:0509959951f39edf73bd9e52791c7f10c4d8411af3983e83e064cc7727bf2fc1

      (For aarch64 architecture)
      The image digest is sha256:b2ca04412aab2f1ea02e93679861366fd80c2b25186e8748d8a1f1558e8d62cf

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.