CVE-2023-6507 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-6507MEDIUM

Python Software Foundation CPython — Groups not dropped before running subprocess when using empty 'extra_groups' parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  N  H  N    4.9   .0133   68.7     —

AFFECTED
  Product  Versions     Fixed
  CPython  unspecified  —

TIMELINE
  Dec 4   Reserved by PSF
  Dec 8   Published (CNA: PSF)
  Jul 31  RESCORED — CVE-2023-6507 (Python Software Foundation CPython). CVSS 6.1 → 4.9 (NVD).

CWE-269 · CNA: PSF · CVSS v3.1 · 5 references · NVD status: Modified

Description

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
December 4, 2023	Reserved	Reserved by PSF
December 8, 2023	Published	Published (CNA: PSF)
July 31, 2026	RESCORED	RESCORED — CVE-2023-6507 (Python Software Foundation CPython). CVSS 6.1 → 4.9 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Python Software Foundation	CPython	—	—	—

Weaknesses

CWE-269

References (5)

Authoritative record: CVE-2023-6507 at cve.org

Vendors: python software foundation

Weaknesses: CWE-269

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-6507 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.