Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4z89-3tfk-pyge
Vulnerability ID VCID-4z89-3tfk-pyge
Aliases CVE-2023-40217
Summary Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation.
Status Published
Exploitability 0.5
Weighted Severity 7.7
Risk 3.9
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-305 Authentication Bypass by Primary Weakness
System Score Found at
cvssv3 8.6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-40217.json
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00597 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00597 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00597 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
epss 0.00597 https://api.first.org/data/v1/epss?cve=CVE-2023-40217
cvssv3.1 7.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
ssvc Track https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
ssvc Track https://mail.python.org/archives/list/security-announce%40python.org/thread/PEPLII27KYHLF4AK3ZQGKYNCRERG4YXY/
ssvc Track https://security.netapp.com/advisory/ntap-20231006-0014/
ssvc Track https://www.python.org/dev/security/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-40217.json
https://api.first.org/data/v1/epss?cve=CVE-2023-40217
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40217
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2235789 https://bugzilla.redhat.com/show_bug.cgi?id=2235789
GLSA-202405-01 https://security.gentoo.org/glsa/202405-01
msg00017.html https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
msg00022.html https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
ntap-20231006-0014 https://security.netapp.com/advisory/ntap-20231006-0014/
PEPLII27KYHLF4AK3ZQGKYNCRERG4YXY https://mail.python.org/archives/list/security-announce%40python.org/thread/PEPLII27KYHLF4AK3ZQGKYNCRERG4YXY/
RHSA-2023:5456 https://access.redhat.com/errata/RHSA-2023:5456
RHSA-2023:5462 https://access.redhat.com/errata/RHSA-2023:5462
RHSA-2023:5463 https://access.redhat.com/errata/RHSA-2023:5463
RHSA-2023:5472 https://access.redhat.com/errata/RHSA-2023:5472
RHSA-2023:5528 https://access.redhat.com/errata/RHSA-2023:5528
RHSA-2023:5531 https://access.redhat.com/errata/RHSA-2023:5531
RHSA-2023:5990 https://access.redhat.com/errata/RHSA-2023:5990
RHSA-2023:5991 https://access.redhat.com/errata/RHSA-2023:5991
RHSA-2023:5992 https://access.redhat.com/errata/RHSA-2023:5992
RHSA-2023:5993 https://access.redhat.com/errata/RHSA-2023:5993
RHSA-2023:5994 https://access.redhat.com/errata/RHSA-2023:5994
RHSA-2023:5995 https://access.redhat.com/errata/RHSA-2023:5995
RHSA-2023:5996 https://access.redhat.com/errata/RHSA-2023:5996
RHSA-2023:5997 https://access.redhat.com/errata/RHSA-2023:5997
RHSA-2023:5998 https://access.redhat.com/errata/RHSA-2023:5998
RHSA-2023:6068 https://access.redhat.com/errata/RHSA-2023:6068
RHSA-2023:6069 https://access.redhat.com/errata/RHSA-2023:6069
RHSA-2023:6290 https://access.redhat.com/errata/RHSA-2023:6290
RHSA-2023:6793 https://access.redhat.com/errata/RHSA-2023:6793
RHSA-2023:6823 https://access.redhat.com/errata/RHSA-2023:6823
RHSA-2023:6885 https://access.redhat.com/errata/RHSA-2023:6885
security https://www.python.org/dev/security/
USN-6513-1 https://usn.ubuntu.com/6513-1/
USN-6513-2 https://usn.ubuntu.com/6513-2/
USN-6891-1 https://usn.ubuntu.com/6891-1/
USN-7180-1 https://usn.ubuntu.com/7180-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-40217.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-02T16:31:39Z/ Found at https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-02T16:31:39Z/ Found at https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-02T16:31:39Z/ Found at https://mail.python.org/archives/list/security-announce%40python.org/thread/PEPLII27KYHLF4AK3ZQGKYNCRERG4YXY/
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-02T16:31:39Z/ Found at https://security.netapp.com/advisory/ntap-20231006-0014/
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-02T16:31:39Z/ Found at https://www.python.org/dev/security/
Exploit Prediction Scoring System (EPSS)
Percentile 0.68929
EPSS Score 0.00581
Published At April 9, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:02:04.738467+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202405-01 38.0.0