CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions
nfpm fails to preserve file permissions, potentially exposing sensitive files with world-readable or writable permissions in generated packages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32698?
CVE-2023-32698 is a high-severity vulnerability in goreleaser nfpm, published on 30 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.
Weakness: CWE-276
Which versions are affected by CVE-2023-32698?
5 open source packages ship an affected version, including github.com/goreleaser/nfpm/v2 and github.com/goreleaser/nfpm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/goreleaser/nfpm/v2 Go | From 2.0.0 | 2.29.0 |
github.com/goreleaser/nfpm/v2 Go | From 2.0.0 | 2.29.0 |
github.com/goreleaser/nfpm/v2 Go | From 2.0.0 | 2.29.0 |
github.com/goreleaser/nfpm Go | From 0.1.0 to 1.10.3 | None |
github.com/goreleaser/nfpm Go | From 0.1.0 to 1.10.3 | None |
Products include Goreleaser Nfpm.
How do I fix CVE-2023-32698?
Upgrade github.com/goreleaser/nfpm/v2 to 2.29.0 or later.
Is CVE-2023-32698 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32698 exists.
Sources
Also known as GHSA-w7jw-q4fg-qc4c, GO-2023-1788.