CVE-2018-0023: JSNAPy allows unprivileged local users to alter files under the directory
Summary
CVE-2018-0023: JSNAPy allows unprivileged local users to alter files under the directory. Affects jsnapy versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. It is an automation tool used for managing and administering Junos devices. JSNAPy allows users to create and execute snapshots of device configurations and compare them against predefined templates. This helps in automating network testing and verification processes. However, versions prior to 1.3.0 have a vulnerability where the default configuration and sample files are created with world-writable permissions. This allows unprivileged local users to modify the files under this directory, potentially inserting unintended operations.
Vulnerability Detail
The insecure file and directory permissions in JSNAPy versions prior to 1.3.0 can be exploited by unprivileged local users. By altering the files under the directory, these users can introduce unauthorized operations that were not intended by the package maintainer, system administrator, or other users. This vulnerability only affects users who downloaded and installed JSNAPy from github. The impact of this vulnerability can range from unauthorized modifications to the JSNAPy configuration and sample files, potentially leading to system instability or security breaches.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
pip install --upgrade "jsnapy==1.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
JSNAPy versions prior to 1.3.0 have a vulnerability that allows unprivileged local users to alter files under the directory. This can lead to unauthorized modifications and potential security breaches. Users should upgrade to JSNAPy 1.3.0 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for jsnapy →
FAQ
JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper. It is an automation tool used for managing and administering Junos devices.
The vulnerability allows unprivileged local users to alter files under the JSNAPy directory, potentially introducing unauthorized operations and compromising the integrity of the system.
This vulnerability affects users who downloaded and installed JSNAPy from github, specifically versions prior to 1.3.0.
To fix this vulnerability, users should upgrade to JSNAPy version 1.3.0 or later. This version addresses the insecure file and directory permissions.
No specific workaround has been mentioned for this vulnerability.
