VulnerabilityModified
CVE-2023-32698
nFPM is an alternative to fpm.
HIGH 7.1EPSS 0.38%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.38% probability · 32th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-276
- Affected
- goreleaser/nfpm
- Source
- security-advisories@github.com
References
- https://github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30Patch
- https://github.com/goreleaser/nfpm/releases/tag/v2.29.0Release Notes
- https://github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4cExploit, Mitigation, Vendor Advisory
- https://github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30Patch
- https://github.com/goreleaser/nfpm/releases/tag/v2.29.0Release Notes
- https://github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4cExploit, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.