debian/rust-pleaser vulnerabilities

Latest debian/rust-pleaser CVEs

Newest publication first

1. CVE-2023-46277 Pleaser privilege escalation vulnerability

   Published 2023-10-20

   High·CVSS 7.8 EPSS 0.31%

   please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

2. CVE-2021-31155 Permissions bypass in pleaser

   Published 2021-05-27

   High·CVSS 7.8 EPSS 0.41%

   Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

3. CVE-2021-31154 Permissions bypass in pleaser

   Published 2021-05-27

   High·CVSS 7.8 EPSS 0.47%

   pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

4. CVE-2021-31153 File exposure in pleaser

   Published 2021-05-27

   Low·CVSS 3.3 EPSS 0.43%

   please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.