PT-2023-28701 · Buildkit · Buildkite Elastic Ci For Aws

Name of the Vulnerable Software and Affected Versions: Buildkite Elastic CI for AWS versions prior to 6.7.1 Buildkite Elastic CI for AWS versions prior to 5.22.5 Description: A symbolic link following issue allows the buildkite-agent user to change ownership of arbitrary directories via the...

CVE-2023-43741

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43741

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

Buildkite Elastic CI Stack for AWS Security Vulnerability

Buildkite Elastic CI Stack for AWS is an application from Buildkite that provides private, auto-scaling clusters of Buildkite Agents. A security vulnerability exists in Buildkite Elastic CI Stack for AWS versions prior to 6.7.1, and prior to 5.22.5, which stems from the introduction of a TOCTOU...

CVE-2023-43116

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

Buildkite Elastic CI Stack for AWS Security Vulnerability

Buildkite Elastic CI Stack for AWS is an application from Buildkite that provides private, auto-scaling clusters of Buildkite Agents. A security vulnerability exists in Buildkite Elastic CI Stack for AWS versions prior to 6.7.1, prior to 5.22.5, which stems from a symbolic link that allows...

MAL-2022-4162 Malicious code in kibana-buildkite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36ce94ea8ca19ba2d2a77464d1224d6dd6158421317cc7f2bf75a00f3454729c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4163 Malicious code in kibana-buildkite-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b8915368d81f052cb059c635e8c9ac725f86e6f1369375961b9687be940b4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kibana-buildkite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36ce94ea8ca19ba2d2a77464d1224d6dd6158421317cc7f2bf75a00f3454729c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kibana-buildkite-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b8915368d81f052cb059c635e8c9ac725f86e6f1369375961b9687be940b4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...