CVE-2023-32303 Planet's secret file is created with excessive permissions
Local attackers can read the Planet API secret file due to excessive permissions, exposing authentication credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32303?
CVE-2023-32303 is a medium-severity vulnerability in planetlabs planet-client-python, published on 12 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.
Weakness: CWE-732
Which versions are affected by CVE-2023-32303?
3 open source packages ship an affected version, including planet. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
planet PyPI | All versions | 2.0.1 |
planet PyPI | All versions | 2.0.1 |
planet PyPI | All versions | 2.0.1 |
Products include Planet Planet.
How do I fix CVE-2023-32303?
Upgrade planet to 2.0.1 or later.
Is CVE-2023-32303 being exploited?
There is no known exploitation of CVE-2023-32303 in the wild and no public exploit code.
Sources
Also known as GHSA-j5fj-rfh6-qj85, PYSEC-2023-71.