PT-2021-4107 · Please+1 · Please+1

Matthias Gerstner · Published 2021-03-17 · Updated 2022-07-12 · CVE-2021-31153

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions please versions prior to 0.4

Description The issue is related to the search path function and the --check option, -d of the please utility, which can lead to information disclosure in error messages. An attacker can exploit this to gain knowledge about the existence of files or directories in privileged locations.

Recommendations For versions prior to 0.4, consider disabling the search path function, the --check option, or the -d option as a temporary workaround until a patch is available. Restrict access to privileged locations to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

BDU:2021-04694

CVE-2021-31153

GHSA-F3FG-5J9P-VCHC

RUSTSEC-2021-0104

Affected Products

Ubuntu

Please

References · 15

• 🔥 http://openwall.com/lists/oss-security/2021/05/18/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-31153 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-31153 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0104 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31153 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-31153 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04694 · Security Note
• https://osv.dev/vulnerability/GHSA-f3fg-5j9p-vchc · Vendor Advisory
• https://t.me/cvenotify/15768 · Telegram Post
• https://crates.io/crates/pleaser · Note
• https://t.me/tmfeed/111637 · Telegram Post
• https://gitlab.com/edneville/please/-/tree/master/src/bin · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0104.html · Note
• https://bugzilla.suse.com/show_bug.cgi?id=1183669 · Note
• https://t.me/opennews/8554 · Telegram Post