Lucene search

Veracode Vulnerability DatabaseVERACODE:11057

HistoryJan 15, 2019 - 8:56 a.m.

Escalation Of Privileges

2019-01-1508:56:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.045 Low

EPSS

Percentile

92.5%

JSON

PasteScript is vulnerable to privilege escalation. This vulnerability is caused because PasteScript does not set group memberships during execution with root privileges. By leveraging a web application that uses the local filesystem, attackers are able to bypass intended file-access restrictions.

CPENameOperatorVersion
python-paste-scripteq1.7.3__4.el6

CPE	Name	Operator	Version
	python-paste-script	eq	1.7.3__4.el6

References

groups.google.com/group/paste-users/browse_thread/thread/2aa651ba331c2471

rhn.redhat.com/errata/RHSA-2012-1206.html

secunia.com/advisories/48812

secunia.com/advisories/50410

www.openwall.com/lists/oss-security/2012/02/23/1

www.openwall.com/lists/oss-security/2012/02/23/4

access.redhat.com/security/updates/classification/#moderate

bitbucket.org/ianb/pastescript/changeset/a19e462769b4

bitbucket.org/ianb/pastescript/pull-request/3/fix-group-permissions-for-pastescriptserve

bugzilla.redhat.com/show_bug.cgi?id=796790