PT-2023-23971 · Nfpm · Nfpm

Ochriso · Published 2023-05-24 · Updated 2023-06-06 · CVE-2023-32698

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions nfpm (affected versions not specified)

Description The issue arises when nfpm packages files without maintaining the original file permissions from the source control. This can result in files being packaged with incorrect permissions, such as chmod 666 or 777, if no extra configuration is provided to enforce its own permissions. Anyone using nfpm to create packages without checking or setting file permissions before packaging could end up with files or folders having bad permissions.

Recommendations To prevent world-writable files from making it into the packages, add the ability to override the default permissions of packaged files using a umask config option in the packaging spec file. This feature in nfpm would allow applying a global umask across any files being packaged, therefore, with the correct configuration, preventing world-writable files without needing to list permissions on each and every file in the package.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2023-32698

GHSA-W7JW-Q4FG-QC4C

GO-2023-1788

Affected Products

Nfpm

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32698.json · Exploit
• 🔥 https://github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4c · Exploit
• https://github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-32698 · Security Note
• https://osv.dev/vulnerability/GHSA-w7jw-q4fg-qc4c · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1788 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32698 · Vendor Advisory
• https://github.com/goreleaser/nfpm/releases/tag/v2.29.0 · Note
• https://github.com/goreleaser/nfpm · Note
• https://t.me/cibsecurity/64775 · Telegram Post
• https://github.com/advisories/GHSA-w7jw-q4fg-qc4c · Note