Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wZjV2LXBxZnYteDhqas4ABAQZ

OpenCanary Executes Commands From Potentially Writable Config File

Impact

OpenCanary directly executed commands taken from its config file. Where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon.

Thanks to the folks at Whirlylabs for finding and fixing this.

Patches

Upgrade to 0.9.4 or higher.

Permalink: https://github.com/advisories/GHSA-pf5v-pqfv-x8jj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZjV2LXBxZnYteDhqas4ABAQZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 1 day ago
Updated: about 18 hours ago

Identifiers: GHSA-pf5v-pqfv-x8jj, CVE-2024-48911
References:

• https://github.com/thinkst/opencanary/security/advisories/GHSA-pf5v-pqfv-x8jj
• https://github.com/thinkst/opencanary/commit/2c11575b1a3dd8b0df26a879ba856c0aa350c049
• https://github.com/thinkst/opencanary/releases/tag/v0.9.4
• https://nvd.nist.gov/vuln/detail/CVE-2024-48911
• https://github.com/advisories/GHSA-pf5v-pqfv-x8jj

Repository: https://github.com/thinkst/opencanary
Blast Radius: 0.0

Affected Packages