CVE-2021-31155: Permissions bypass in pleaser

August 25, 2021 (updated April 3, 2023)

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.

References

crates.io/crates/pleaser
github.com/advisories/GHSA-vc5p-j8vw-mc6x
gitlab.com/edneville/please
gitlab.com/edneville/please/-/tree/master/src/bin
nvd.nist.gov/vuln/detail/CVE-2021-31155
rustsec.org/advisories/RUSTSEC-2021-0101.html
www.openwall.com/lists/oss-security/2021/05/18/1

Code Behaviors & Features

Detect and mitigate CVE-2021-31155 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →