GitHub Advisoryadvisory · crates.io

GHSA-pp74-39w2-v4w9 Permissions bypass in pleaser

HIGH Published 2021-08-25 Modified 2023-04-03 Official page ↗
Aliases
CVE-2021-31154
Ecosystem
crates.io
Packages
pleaser
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-340, CWE-59
Reviewed
2021-06-01

Affected packages

• crates.io pleaser: < 0.4.0 → fixed in 0.4.0

Description

pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Related

Alias · CVE (1)

  • CVE-2021-31154 pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. vulnerability

Weakness · CWE (2)

  • CWE-340 Generation of Predictable Numbers or Identifiers weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References