PT-2023-23971 · Nfpm · Nfpm

Ochriso · Publicado 2023-05-24 · Atualizado 2023-06-06 · CVE-2023-32698

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions nfpm (affected versions not specified)

Description The issue arises when nfpm packages files without maintaining the original file permissions from the source control. This can result in files being packaged with incorrect permissions, such as chmod 666 or 777, if no extra configuration is provided to enforce its own permissions. Anyone using nfpm to create packages without checking or setting file permissions before packaging could end up with files or folders having bad permissions.

Recommendations To prevent world-writable files from making it into the packages, add the ability to override the default permissions of packaged files using a umask config option in the packaging spec file. This feature in nfpm would allow applying a global umask across any files being packaged, therefore, with the correct configuration, preventing world-writable files without needing to list permissions on each and every file in the package.

Exploit

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2023-32698

GHSA-W7JW-Q4FG-QC4C

GO-2023-1788

Produtos afetados

Nfpm

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32698.json · Exploit
• 🔥 https://github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4c · Exploit
• https://github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30 · Correção
• https://github.com/goreleaser/nfpm/releases/tag/v2.29.0 · Nota
• https://github.com/goreleaser/nfpm · Nota
• https://t.me/cibsecurity/64775 · Publicação no Telegram
• https://github.com/advisories/GHSA-w7jw-q4fg-qc4c · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-32698 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-w7jw-q4fg-qc4c · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1788 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-32698 · Aviso do Fabricante