{
  "cveId": "CVE-2023-6507",
  "url": "https://patchblox.com/security/cve/CVE-2023-6507",
  "summary": "CVE-2023-6507 is fixed in 2 products on 1 platform, first by Python 3.12 3.12.1, released December 7, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Groups not dropped before running subprocess when using empty \u0027extra_groups\u0027 parameter",
  "description": "An issue was found in CPython 3.12.0 \u0060subprocess\u0060 module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.\n\nWhen using the \u0060extra_groups=\u0060 parameter with an empty list as a value (ie \u0060extra_groups=[]\u0060) the logic regressed to not call \u0060setgroups(0, NULL)\u0060 before calling \u0060exec()\u0060, thus not dropping the original processes\u0027 groups before starting the new process. There is no issue when the parameter isn\u0027t used or when any value is used besides an empty list.\n\nThis issue only impacts CPython processes run with sufficient privilege to make the \u0060setgroups\u0060 system call (typically \u0060root\u0060).",
  "published": "2023-12-08T19:15:08Z",
  "severity": "",
  "cvss": 4.9,
  "cwe": "CWE-269: Improper Privilege Management",
  "epss": 0.01337,
  "epssPercentile": 0.71396,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2023-6507",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Python 3.12",
      "fixedVersion": "3.12.1",
      "fix": "Python 3.12 3.12.1",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.12-3.12.1",
      "released": "2023-12-07T00:00:00Z"
    },
    {
      "platform": "windows-app",
      "product": "Python 3.13",
      "fixedVersion": "3.13.1",
      "fix": "Python 3.13 3.13.1",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.13-3.13.1",
      "released": "2024-12-03T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}