nfpm has incorrect default permissions

🗓️ 24 May 2023 17:30:16Reported by GitHub Advisory DatabaseType

nfpm default permissions issue when building packages from source control without maintaining file permissions. Files could go out with bad permissions like chmod 666 or 777. Preventable by configuring umask in packaging spec file to override default permissions

Reporter	Title	Published	Views	Family All 18
AlpineLinux	CVE-2023-32698	30 May 202304:15	–	alpinelinux
Chainguard	CVE-2023-32698 vulnerabilities	30 May 202304:15	–	cgr
Circl	CVE-2023-32698	24 May 202301:46	–	circl
CNNVD	nFPM 安全漏洞	30 May 202300:00	–	cnnvd
CVE	CVE-2023-32698	30 May 202303:56	–	cve
Cvelist	CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions	30 May 202303:56	–	cvelist
EUVD	EUVD-2023-1637	3 Oct 202520:07	–	euvd
NVD	CVE-2023-32698	30 May 202304:15	–	nvd
OSV	CGA-FW5X-X4P6-39WR	6 Jun 202412:25	–	osv
OSV	CGA-XHV2-J75H-V2XH	29 Jan 202600:48	–	osv

Vulners

Node

goreleaser nfpmRange0.1.0–1.10.3go

goreleaser nfpmRange2.0.0–2.29.0go

Source	Link
github	www.github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4c
github	www.github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30
github	www.github.com/goreleaser/nfpm/releases/tag/v2.29.0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-32698
github	www.github.com/advisories/GHSA-w7jw-q4fg-qc4c

20 May 2024 21:52Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.1

EPSS0.00059

SSVC

CWE-276