CVE-2023-32698
CVSS V2 None
CVSS V3 None
Description
nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged
the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.
Overview
- CVE ID
- CVE-2023-32698
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2023-05-30T03:56:30.807Z
- Last Modified Date
- 2023-05-30T03:56:30.807Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4c | x_refsource_CONFIRM |
| https://github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30 | x_refsource_MISC |
| https://github.com/goreleaser/nfpm/releases/tag/v2.29.0 | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-32698 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32698 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-25 11:33:44 | Added to TrackCVE |