--- title: "CVE-2023-6507\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2023-6507?format=md keywords: index, follow --- # CVE-2023-6507 Publication date 8 December 2023 Last updated 4 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **4.9 · Medium** [Score breakdown](https://ubuntu.com/security/CVE-2023-6507?format=md#impact-score) Toggle side navigation ## Description An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra\_groups=` parameter with an empty list as a value (ie `extra\_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`). [Read the notes from the security team](https://ubuntu.com/security/CVE-2023-6507?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | python3.10 | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.04 LTS jammy | Not affected | | 20.04 LTS focal | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | python3.11 | 24.04 LTS noble | Not in release | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.04 LTS jammy | Not affected | | 20.04 LTS focal | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | python3.12 | 24.04 LTS noble | Not affected | | 23.10 mantic | Fixed 3.12.0-1ubuntu0.1 | | 23.04 lunar | Not in release | | 22.04 LTS jammy | Not in release | | 20.04 LTS focal | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | python3.7 | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.04 LTS jammy | Not in release | | 20.04 LTS focal | Not in release | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | python3.9 | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.04 LTS jammy | Not in release | | 20.04 LTS focal | Not affected | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | python2.7 | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.04 LTS jammy | Not affected | | 20.04 LTS focal | Not affected | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not affected | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2023-6507?format=md#patch-details) ## Notes --- ### [mdeslaur](https://launchpad.net/~mdeslaur) only affects 3.12.0, no earlier releases ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | python3.12 | * Upstream: | ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 4.9 · Medium * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | High | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | High | | Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 4.9 · Medium | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6507) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-6507) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2023-6507) * [Debian](https://security-tracker.debian.org/tracker/CVE-2023-6507) ### Related Ubuntu Security Notices (USN) + [USN-6891-1](https://usn.ubuntu.com/USN-6891-1) + Python vulnerabilities + 11 July 2024 ### Other references * *