GitHub Advisoryadvisory · PyPI

GHSA-j5fj-rfh6-qj85 Planet's secret file is created with excessive permissions

HIGH Published 2023-05-12 Modified 2024-10-11 Official page ↗
Aliases
CVE-2023-32303
Ecosystem
PyPI
Packages
planet
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-732
Reviewed
2023-05-12

Affected packages

• PyPI planet: < 2.0.1 → fixed in 2.0.1

Description

Impact The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but its permissions allowed the user's group and non-group to read the file as well. Validation Check the permissions on the secret file with `ls -l ~/.planet.json` and ensure that they read as `-rw-------` Patches d71415a8 Workarounds Set the secret file permissions to only user read/write by hand: ``` chmod 600 ~/.planet.json ```

Related

Alias · CVE (1)

  • CVE-2023-32303 Planet is software that provides satellite data. vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References