Security Update for eject Package
Summary
DSA-3823-1: eject - security update. Affects eject versions < 2.1.5+deb1+cvs20081104-13.1+deb8u1. Fixed in 2.1.5+deb1+cvs20081104-13.1+deb8u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The eject package is a utility used to eject removable media such as CDs or DVDs from a computer's optical drive. It provides a command-line interface for ejecting and closing the drive tray. The package is commonly used in Linux distributions, including Debian 8 (Jessie).
Vulnerability Detail
The vulnerability, identified as CVE-2017-6964, was discovered by Ilja Van Sprundel. It affects the dmcrypt-get-device helper used by eject to check if a given device is an encrypted device handled by devmapper. The vulnerability arises from the failure to properly check return values from setuid() and setgid() when dropping privileges. An attacker could exploit this vulnerability to gain elevated privileges and potentially execute arbitrary code.
How To Fix
Minimum fixed version
2.1.5+deb1+cvs20081104-13.1+deb8u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ejectTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to apply the security update as soon as possible to mitigate the risk.
Conclusion
It is crucial to apply the security update for the eject package to protect against this vulnerability. Upgrading to the fixed version will ensure that the vulnerability is patched and the system remains secure. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for eject →
FAQ
The eject package is a utility used to eject removable media such as CDs or DVDs from a computer's optical drive.
This vulnerability could allow an attacker to gain elevated privileges and potentially execute arbitrary code.
The vulnerability affects version 2.1.5+deb1+cvs20081104-13.1+deb8u1 and earlier versions of the eject package for Debian 8 (Jessie).
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
You can find more information about this vulnerability in the Debian Security Advisory DSA-3823-1 (https://storage.googleapis.com/debian-osv/dsa-osv/DSA-3823-1.json).
Related vulnerabilities
Recent vulnerabilities recorded for eject.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
