PT-2023-26477 · Apptainer · Apptainer

Cclerget · Publicado 2023-07-25 · Atualizado 2024-08-20 · CVE-2023-38496

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Apptainer versions 1.2.0-rc.2 through 1.2.0

Description Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges. The attack surface is rather limited for users, but an attacker could possibly craft a starter config to delete any directory on the host filesystems.

Recommendations For Apptainer versions 1.2.0-rc.2, upgrade to Apptainer 1.2.1 to resolve the issue. There is no known workaround outside of upgrading to Apptainer 1.2.1.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-271

CWE-269

Identificadores relacionados

CVE-2023-38496

GHSA-MMX5-32M4-WXVX

GO-2023-1965

OPENSUSE-SU-2024:0244-1

OPENSUSE-SU-2024:13073-1

Produtos afetados

Apptainer

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38496.json · Exploit
• https://github.com/apptainer/apptainer · Nota
• https://github.com/apptainer/apptainer/pull/1578 · Correção
• https://github.com/apptainer/apptainer/security/advisories/GHSA-mmx5-32m4-wxvx · Aviso do Fabricante
• https://github.com/apptainer/apptainer/pull/1523 · Correção
• https://osv.dev/vulnerability/GO-2023-1965 · Aviso do Fabricante
• https://bugzilla.suse.com/1221364 · Nota
• https://osv.dev/vulnerability/GHSA-mmx5-32m4-wxvx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38496 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:0244-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-38496 · Nota
• https://osv.dev/vulnerability/CVE-2023-38496 · Aviso do Fabricante
• https://bugzilla.suse.com/1224114 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/3BEJQC6TDQZLJ4YE746IHLCFJFUQ2JKQ · Nota
• https://t.me/cvenotify/55157 · Publicação no Telegram