PT-2021-4105 · Please+1 · Please+1

Matthias Gerstner · Published 2021-03-17 · Updated 2022-07-12 · CVE-2021-31155

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pleaser versions prior to 0.4.0

Description The issue is related to a failure to normalize the umask in the please utility, which can allow a local attacker to gain full root privileges if they are allowed to execute at least one command. This can lead to unauthorized access to confidential data, disruption of data integrity, and denial of service.

Recommendations For versions prior to 0.4.0, update to version 0.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the execution of commands that utilize the please utility to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

Improper Privilege Management

Weakness Enumeration

CWE-732

CWE-279

CWE-269

Related Identifiers

BDU:2021-04692

CVE-2021-31155

GHSA-VC5P-J8VW-MC6X

RUSTSEC-2021-0101

Affected Products

Ubuntu

Please

References · 14

• 🔥 https://openwall.com/lists/oss-security/2021/05/18/1 · Exploit
• https://osv.dev/vulnerability/GHSA-vc5p-j8vw-mc6x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31155 · Security Note
• https://bdu.fstec.ru/vul/2021-04692 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31155 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-31155 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-31155 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0101 · Vendor Advisory
• https://crates.io/crates/pleaser · Note
• https://t.me/tmfeed/111637 · Telegram Post
• https://gitlab.com/edneville/please/-/tree/master/src/bin · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0101.html · Note
• https://t.me/opennews/8554 · Telegram Post
• https://gitlab.com/edneville/please · Note