PT-2024-20766 · Treasure Data · Digdag

P- · Published 2024-02-13 · Updated 2024-10-21 · CVE-2024-25125

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Digdag versions prior to 0.10.5.1

Description The issue is a path traversal vulnerability in Treasure Data's digdag workload automation system when it is configured to store log files locally. This may lead to information disclosure.

Recommendations For versions prior to 0.10.5.1, upgrade to release version 0.10.5.1 to resolve the issue. As a temporary workaround, consider disabling local log file storage until the upgrade is applied. Restrict access to sensitive information to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-25125

GHSA-5MP4-32RR-V3X5

Affected Products

Digdag

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25125.json · Exploit
• https://github.com/treasure-data/digdag/security/advisories/GHSA-5mp4-32rr-v3x5 · Vendor Advisory
• https://github.com/treasure-data/digdag/commit/eae89b0daf6c62f12309d8c7194454dfb18cc5c3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-25125 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25125 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5mp4-32rr-v3x5 · Vendor Advisory
• https://github.com/treasure-data/digdag · Note
• https://t.me/cvenotify/99023 · Telegram Post
• https://twitter.com/CVEnew/status/1757585157949731017 · Twitter Post