CVE-2021-3978: Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki

November 19, 2021 (updated January 29, 2025)

When copying files with rsync, octorpki uses the “-a” flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root (https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation.

References

github.com/advisories/GHSA-3pqh-p72c-fj85
github.com/cloudflare/cfrpki
github.com/cloudflare/cfrpki/security/advisories/GHSA-3pqh-p72c-fj85
nvd.nist.gov/vuln/detail/CVE-2021-3978

Code Behaviors & Features

Detect and mitigate CVE-2021-3978 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →