GitHub Advisoryadvisory · crates.io

GHSA-vc5p-j8vw-mc6x Permissions bypass in pleaser

HIGH Published 2021-08-25 Modified 2023-04-03 Official page ↗
Aliases
CVE-2021-31155
Ecosystem
crates.io
Packages
pleaser
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269, CWE-279
Reviewed
2021-06-01

Affected packages

• crates.io pleaser: < 0.4.0 → fixed in 0.4.0

Description

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

Related

Alias · CVE (1)

  • CVE-2021-31155 Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-279 Incorrect Execution-Assigned Permissions weakness

References