Rooba
/
cpython
mirror of https://github.com/python/cpython.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

gh-118486: Update docs for CVE-2024-4030 reference (GH-118737)

This commit is contained in:
Steve Dower 2024-05-08 16:52:39 +01:00 committed by GitHub
parent 891fd12e52
commit 66f8bb76a1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Doc/whatsnew/3.13.rst
View File

@ -847,6 +847,12 @@ os
:c:func:`!posix_spawn_file_actions_addclosefrom_np`.
(Contributed by Jakub Kulik in :gh:`113117`.)
* :func:`os.mkdir` and :func:`os.makedirs` on Windows now support passing a
*mode* value of ``0o700`` to apply access control to the new directory. This
implicitly affects :func:`tempfile.mkdtemp` and is a mitigation for
:cve:`2024-4030`. Other values for *mode* continue to be ignored.
(Contributed by Steve Dower in :gh:`118486`.)
os.path
-------
@ -989,6 +995,14 @@ sys
This function is not guaranteed to exist in all implementations of Python.
(Contributed by Serhiy Storchaka in :gh:`78573`.)
tempfile
--------
* On Windows, the default mode ``0o700`` used by :func:`tempfile.mkdtemp` now
limits access to the new directory due to changes to :func:`os.mkdir`. This
is a mitigation for :cve:`2024-4030`.
(Contributed by Steve Dower in :gh:`118486`.)
time
----

4
Misc/NEWS.d/next/Security/2024-05-01-20-57-09.gh-issue-118486.K44KJG.rst Normal file
View File

@ -0,0 +1,4 @@
:func:`os.mkdir` on Windows now accepts *mode* of ``0o700`` to restrict
the new directory to the current user. This fixes :cve:`2024-4030`
affecting :func:`tempfile.mkdtemp` in scenarios where the base temporary
directory is more permissive than the default.