CVE-2023-38496

Katalog CVE

CVSS 3.3 · Low EPSS 0,26%

Kerentanan Improper Privilege Management pada lfprojects apptainer. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.

Rincian

Terbit di NVD

25 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-271: Privilege Dropping / Lowering Errors

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/apptainer/apptainer/security/advisories/GHSA-mmx5-32m4-wxvx patch · advisory vendor
• https://github.com/apptainer/apptainer/pull/1523 patch
• https://github.com/apptainer/apptainer/pull/1578 patch