VDB

CVE-2023-32698

CVE-2023-32698 PUBLISHED CVSS 7.099999904632568 HIGH

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.

EPSS 0.38% · 32.2th percentile

Risk Scores

CVSS 3.1
7.099999904632568
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
0.38%
32.2th percentile

Affected Products

VendorProductVersions
github.comgoreleaser/nfpm/v22.0.0, 2.0.0
github.comgoreleaser/nfpm0.1.0, 0.1.0
goreleasernfpm>= 2.0.0, < 2.29.0, >= 0.1.0, < 2.29.0, 0.1.0

Timeline

  • May 24, 2023 CVE Published
  • May 30, 2023 EPSS Score
  • May 30, 2023 PoC Published
  • Jul 6, 2023 EPSS Score
  • Aug 12, 2023 EPSS Score
  • Sep 17, 2023 EPSS Score
  • Oct 24, 2023 EPSS Score
  • Nov 30, 2023 EPSS Score
  • Jan 6, 2024 EPSS Score
  • Feb 12, 2024 EPSS Score
  • Mar 20, 2024 EPSS Score
  • Apr 25, 2024 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›