CVE-2012-0878: Improper Group Memberships Permissions in Paste Script
Summary
CVE-2012-0878: Paste Script has improper group memberships permissions. Affects pastescript versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Also tracked for
- pastescript · Debian:11
- paste · PyPI
The same CVE-2012-0878 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Paste Script is a Python package available on PyPI that provides a command-line tool for creating and managing web application templates. It is commonly used in web development projects to scaffold and manage the structure of web applications. The package allows users to generate code, manage dependencies, and perform various tasks related to web application development. However, versions 1.7.5 and earlier of Paste Script have a vulnerability that results in improper group memberships permissions when executed with root privileges. This vulnerability can be exploited by remote attackers through a web application that utilizes the local filesystem, potentially allowing them to bypass intended file-access restrictions.
Vulnerability Detail
The vulnerability in Paste Script arises from the improper setting of group memberships during execution with root privileges. This issue can be leveraged by remote attackers who have access to a web application that uses the local filesystem. By exploiting this vulnerability, attackers may be able to bypass file-access restrictions that are intended to protect sensitive data or system resources. The exact impact of this vulnerability depends on the specific context in which Paste Script is used and the permissions granted to the affected files and directories.
How To Fix
Minimum fixed version
2.0.1
This is the first release that contains the fix.
pip install --upgrade "pastescript==2.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring that the web application utilizing Paste Script is properly configured and restricts access to sensitive files and directories. Additionally, it is important to follow security best practices and regularly update the software to the latest version.
Conclusion
The vulnerability in Paste Script versions 1.7.5 and earlier can lead to improper group memberships permissions when executed with root privileges. This can be exploited by remote attackers through a web application that uses the local filesystem, potentially allowing them to bypass intended file-access restrictions. To mitigate this vulnerability, it is crucial to upgrade to version 2.0.1 or later of Paste Script and follow security best practices. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pastescript →
FAQ
Paste Script is a Python package that provides a command-line tool for creating and managing web application templates.
Versions 1.7.5 and earlier of Paste Script are affected by this vulnerability.
This vulnerability can be exploited by remote attackers through a web application that uses the local filesystem.
The impact of this vulnerability depends on the specific context and permissions granted to the affected files and directories. It may allow attackers to bypass file-access restrictions.
To fix this vulnerability, it is recommended to upgrade to version 2.0.1 or later of Paste Script.
Related vulnerabilities
Recent vulnerabilities recorded for pastescript.
