~ / search / GHSA-pf5v-pqfv-x8jj

GHSA-pf5v-pqfv-x8jj

OpenCanary Executes Commands From Potentially Writable Config File

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-48911

Packages

EcosystemPackageAffectedFixed in
PyPI OpenCanary < 0.9.5 0.9.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact OpenCanary directly executed commands taken from its config file. Where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon. Thanks to the folks at [Whirlylabs](https://whirlylabs.com/) for finding and fixing this. ### Patches Upgrade to 0.9.4 or higher.

References

External links from the advisory. They lead to third-party sites.