PYSEC-2024-248

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/opencanary/PYSEC-2024-248.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2024-248

Aliases

Published

2024-10-14T21:15:12Z

Modified

2025-05-16T14:56:49Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon. Version 0.9.4 contains a fix for the issue.

References

Affected packages

PyPI / opencanary

Package

Name: opencanary; View open source insights on deps.dev
Purl: pkg:pypi/opencanary

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.9.4

Affected versions

0.*

0.2

0.3

0.3.1

0.3.2

0.4

0.5

0.5.1

0.5.2

0.5.4

0.5.5

0.5.6

0.5.7

0.5.8

0.6.0

0.6.1

0.6.2

0.6.3

0.7.1

0.9.0

0.9.1

0.9.2

0.9.3

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/opencanary/PYSEC-2024-248.yaml"