High severity · published May 30, 2023
CVE-2023-32698
nfpm vulnerable to Incorrect Default Permissions
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged
the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
nfpm · goreleaser
>= 2.0.0, < 2.29.0; >= 0.1.0, < 2.29.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32698
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32698
Patch
https://github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30
Release Notes
https://github.com/goreleaser/nfpm/releases/tag/v2.29.0
Exploit
https://github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4c