When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list.
This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Python Software Foundation | CPython | unaffected |
|
Configuration 1 [-]
|
No data.
No data.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-58738 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`). |
 Ubuntu USN |
USN-6891-1 | Python vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Fri, 31 Jul 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Python cpython
|
|
| CPEs | cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:* cpe:2.3:a:python:cpython:3.13.0:*:*:*:*:*:*:* |
|
| Vendors & Products |
Python cpython
|
|
| Metrics |
ssvc
|
Fri, 31 Jul 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`). | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`). |
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: PSF
Published:
Updated: 2026-07-31T14:09:16.715Z
Reserved: 2023-12-04T21:24:50.284Z
Link: CVE-2023-6507
Vulnrichment
Updated: 2024-08-02T08:35:13.267Z
NVD
Status : Modified
Published: 2023-12-08T19:15:08.440
Modified: 2026-06-17T06:50:53.040
Link: CVE-2023-6507
Redhat
OpenCVE Enrichment
No data.