https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:30:54 +0000 https://vulnerability.circl.lu/vuln/cve-2023-6507 <p><strong>Affected:</strong> Python Software Foundation CPython, python cpython</p> <p>An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.</p> <p>When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes&#39; groups before starting the new process. There is no issue when the parameter isn&#39;t used or when any value is used besides an empty list.</p> <p>This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).</p> <p><strong>Affected:</strong> Python Software Foundation CPython, python cpython</p> <p>An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.</p> <p>When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes&#39; groups before starting the new process. There is no issue when the parameter isn&#39;t used or when any value is used besides an empty list.</p> <p>This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).</p> https://vulnerability.circl.lu/vuln/cve-2023-6507