PYSEC-2023-71

Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/planet/PYSEC-2023-71.yaml
Aliases
Published
2023-05-12T21:15:00Z
Modified
2023-11-08T04:12:34.413335Z
Details

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.

References

Affected packages

PyPI / planet

Package

Name
planet

Affected ranges

Type
GIT
Repo
https://github.com/planetlabs/planet-client-python
Events
Introduced
0The exact introduced commit is unknown
Fixed
d71415a83119c5e89d7b80d5f940d162376ee3b7
Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
2.0.1

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6

1.*

1.0.0
1.0.1
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.4.10
1.5.0
1.5.1
1.5.2

2.*

2.0a1
2.0a2
2.0a3
2.0a5.dev0
2.0a5
2.0a6
2.0.0b1
2.0.0rc1
2.0.0rc2
2.0.0