Security features bypass in templated-dictionary - CVE-2023-6395
Published: January 29, 2024
Vulnerability identifier: #VU85880
CSH Severity: Medium
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-6395
CWE-ID: CWE-254
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to absence of proper sandboxing during the expansion and execution of Jinja2 templates. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server.
Affected software
templated-dictionary
Fedora
Anolis OS
python3-templated-dictionary
python-templated-dictionary
Fedora
Anolis OS
python3-templated-dictionary
python-templated-dictionary
How to mitigate CVE-2023-6395
Install updates from vendor's website.
templated-dictionary - update to 1.4-1
python3-templated-dictionary - update to 1.4-1
python-templated-dictionary - addressed in versions 1.4-1.el7, 1.4-1.el8, 1.4-1.el9, 1.4-1.fc38, 1.4-1.fc39
python3-templated-dictionary - update to 1.4-1
python-templated-dictionary - addressed in versions 1.4-1.el7, 1.4-1.el8, 1.4-1.el9, 1.4-1.fc38, 1.4-1.fc39
External References
- https://access.redhat.com/security/cve/CVE-2023-6395
- https://bugzilla.redhat.com/show_bug.cgi?id=2252206
- https://github.com/xsuchy/templated-dictionary/commit/0740bd0ca8d487301881541028977d120f8b8933
- https://github.com/xsuchy/templated-dictionary/commit/bcd90f0dafa365575c4b101e6f5d98c4ef4e4b69
- http://www.openwall.com/lists/oss-security/2024/01/16/1
- http://www.openwall.com/lists/oss-security/2024/01/16/3
Related Security Bulletins
- Privilege escalation in templated-dictionary
- Fedora EPEL 8 update for python-templated-dictionary
- Fedora EPEL 9 update for python-templated-dictionary
- Fedora 39 update for python-templated-dictionary
- Fedora EPEL 7 update for python-templated-dictionary
- Fedora 38 update for python-templated-dictionary
- Anolis OS update for python-templated-dictionary