SB2024012938 - Privilege escalation in templated-dictionary
Published: January 29, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Security features bypass (CVE-ID: CVE-2023-6395)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to absence of proper sandboxing during the expansion and execution of Jinja2 templates. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server.
Remediation
Install update from vendor's website.
References
- https://access.redhat.com/security/cve/CVE-2023-6395
- https://bugzilla.redhat.com/show_bug.cgi?id=2252206
- https://github.com/xsuchy/templated-dictionary/commit/0740bd0ca8d487301881541028977d120f8b8933
- https://github.com/xsuchy/templated-dictionary/commit/bcd90f0dafa365575c4b101e6f5d98c4ef4e4b69
- http://www.openwall.com/lists/oss-security/2024/01/16/1
- http://www.openwall.com/lists/oss-security/2024/01/16/3