CVE-2021-31153: File Exposure in pleaser
Summary
CVE-2021-3115: Arbitrary code injection via the go command with cgo on Windows in cmd/go. Affects toolchain across 2 version ranges.
< 1.14.14
>= 1.15.0-0, < 1.15.7
Fixed in 1.14.14 or 1.15.7, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2021-3115 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pleaser is a package available on crates.io that provides functionality for handling files and directories. It is vulnerable to a file exposure issue in versions prior to 0.4.0. This vulnerability allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations. The issue can be exploited through the search_path function, the --check option, or the -d option.
Vulnerability Detail
The file exposure vulnerability in pleaser can be exploited by an attacker with local access to the system. By using the search_path function, the --check option, or the -d option, the attacker can gather information about files or directories in privileged locations. This can lead to a breach of confidentiality as the attacker gains knowledge of sensitive files or directories that should not be accessible to them. The vulnerability has a CVSS score of 3.3, indicating a low severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.14.141.14.14go get toolchain@v1.14.14 -
>= 1.15.0-0, < 1.15.71.15.7go get toolchain@v1.15.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
In conclusion, pleaser versions prior to 0.4.0 are vulnerable to a file exposure issue that allows an unprivileged attacker to gain knowledge about files or directories in privileged locations. To mitigate this vulnerability, users should upgrade to pleaser version 0.4.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for toolchain →
FAQ
The vulnerability allows an unprivileged attacker to gain knowledge about files or directories in privileged locations, potentially leading to a breach of confidentiality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Cargo.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, upgrading to pleaser version 0.4.0 or later will fix the file exposure issue.
There are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for toolchain.
