CVE-2024-25125 Absolute path traversal vulnerability in digdag server
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-25125?
CVE-2024-25125 is a medium-severity vulnerability in treasure-data digdag, published on 14 Feb 2024.
Official description
Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload automation system is susceptible to a path traversal vulnerability if it's configured to store log files locally. This issue may lead to information disclosure and has been addressed in release version 0.10.5.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2024-25125?
2 open source packages ship an affected version, including io.digdag:digdag-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.digdag:digdag-server Maven | All versions | 0.10.5.1 |
io.digdag:digdag-server Maven | All versions | 0.10.5.1 |
Products include Treasuredata Digdag.
How do I fix CVE-2024-25125?
Upgrade io.digdag:digdag-server to 0.10.5.1 or later.
Is CVE-2024-25125 being exploited?
There is no known exploitation of CVE-2024-25125 in the wild and no public exploit code.
Sources
Also known as GHSA-5mp4-32rr-v3x5.