CVE-2024-3250

CVE-2024-3250 affects Canonical’s Pebble service manager. The issue arises from the read-file API used by the pebble pull command, which, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble ran as root. This could enable access to sensitive ...

CVE-2024-3250: Incorrect Permission Assignment for Critical Resource

It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2,...

PT-2024-24617

Name of the Vulnerable Software and Affected Versions Pebble versions prior to 1.10.2 Pebble versions 1.1.1, 1.4.2, and 1.7.4 are fixed versions, but all versions prior to 1.10.2 are considered vulnerable. Description The issue allows unprivileged local users to read files with root-equivalent...

Pebble security vulnerabilities

Canonical Pebble is a lightweight, API-driven process manager from Canonical, UK. A security vulnerability exists in Pebble that stems from a file pulling API that allows any user to access the Pebble server.Affected products and versions: canonical/pebble v1.4.1, v1.7.3, v1.10.1...

Arbitrary Code Execution Via Authorization Bypass

Pebble Templates is vulnerable to arbitrary code execution via authorization bypass. The vulnerability exists in BlacklistMethodAccessValidator.java because the methods that are allowed to access by pebble are not properly handled which allows an attacker to bypass and execute arbitrary codes...

io.pebbletemplates:pebble-spring-boot-2-starter (2.6.2), io.pebbletemplates:pebble-spring-boot-starter (2.6.2) +3 more potentially affected by CVE-2022-37767 via io.pebbletemplates:pebble (2.6.2)

io.pebbletemplates:pebble MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.pebbletemplates:pebble and may be impacted: - io.pebbletemplates:pebble-spring-boot-2-starter 2.6.2 - io.pebbletemplates:pebble-spring-boot-starter 2.6.2 -...

io.pebbletemplates:pebble-spring-boot-starter (2.5.0), io.pebbletemplates:pebble-spring3 (2.5.0) +1 more potentially affected by CVE-2022-37767 via io.pebbletemplates:pebble (2.5.0)

io.pebbletemplates:pebble MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.pebbletemplates:pebble and may be impacted: - io.pebbletemplates:pebble-spring-boot-starter 2.5.0 - io.pebbletemplates:pebble-spring3 2.5.0 -...

io.pebbletemplates:pebble-spring-boot-starter (2.5.1), io.pebbletemplates:pebble-spring3 (2.5.1) +1 more potentially affected by CVE-2022-37767 via io.pebbletemplates:pebble (2.5.1)

io.pebbletemplates:pebble MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.pebbletemplates:pebble and may be impacted: - io.pebbletemplates:pebble-spring-boot-starter 2.5.1 - io.pebbletemplates:pebble-spring3 2.5.1 -...

ai.djl.timeseries:timeseries (>=0.19.0, <=0.32.0), cc.akkaha:pea-dubbo_2.12 (>=0.1.5, <=0.7.0) +291 more potentially affected by CVE-2022-37767 via io.pebbletemplates:pebble (>=3.0.0.beta01, <=3.1.5)

io.pebbletemplates:pebble MAVEN version =3.0.0.beta01, =0.19.0, =0.1.5, =0.3.0, =0.1.0, =4.1.0, =6.5.1, =6.0.0-rc17, =12.0.0-beta, =12.0.0-beta, =16.0.9 and more Source cves: CVE-2022-37767 Source advisory: OSV:GHSA-WXX5-W9JC-48WX...

io.pebbletemplates:pebble-spring-boot-2-starter (2.6.1), io.pebbletemplates:pebble-spring-boot-starter (2.6.1) +10 more potentially affected by CVE-2022-37767 via io.pebbletemplates:pebble (2.6.1)

io.pebbletemplates:pebble MAVEN version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.pebbletemplates:pebble and may be impacted: - io.pebbletemplates:pebble-spring-boot-2-starter 2.6.1 - io.pebbletemplates:pebble-spring-boot-starter 2.6.1 -...

io.pebbletemplates:pebble-spring-boot-2-starter (2.6.0), io.pebbletemplates:pebble-spring-boot-starter (2.6.0) +8 more potentially affected by CVE-2022-37767 via io.pebbletemplates:pebble (2.6.0)

io.pebbletemplates:pebble MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.pebbletemplates:pebble and may be impacted: - io.pebbletemplates:pebble-spring-boot-2-starter 2.6.0 - io.pebbletemplates:pebble-spring-boot-starter 2.6.0 -...

Pebble Templates protection mechanism bypass can lead to arbitrary code execution

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok...

GHSA-WXX5-W9JC-48WX Pebble Templates protection mechanism bypass can lead to arbitrary code execution

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok...

CVE-2022-37767

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from...

CVE-2022-37767

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from...

Input validation

DISPUTED Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not...

PT-2022-24057 · Unknown · Pebble Templates

Name of the Vulnerable Software and Affected Versions: Pebble Templates version 3.1.5 Description: The issue allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. It is noted that the vendor disputes this, as input to the Pebble templating engine...

CVE-2022-37767

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from...

Pebble Templates security vulnerabilities

Pebble Templates is a Java template engine. A security vulnerability exists in Pebble Templates version 3.1.5 that allows an attacker to bypass protection mechanisms and achieve arbitrary code execution using springbok...

CVE-2022-37767

Pebble Templates 3.1.5 is described as vulnerable to bypassing a protection mechanism that could enable arbitrary code execution via springbok. The root cause cited by multiple sources is improper validation/handling of allowed methods (e.g., BlacklistMethodAccessValidator) within the templating ...