CVE-2023-32696: Improper Privilege Management

May 30, 2023 (updated June 6, 2023)

CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the ckan user (equivalent to www-data) owned code and configuration files in the docker container and the ckan user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.

References

github.com/ckan/ckan-docker-base/commit/5483c46ce9b518a4e1b626ef7032cce2c1d75c7d
github.com/ckan/ckan-docker-base/security/advisories/GHSA-c74x-xfvr-x5wg
nvd.nist.gov/vuln/detail/CVE-2023-32696

Code Behaviors & Features

Detect and mitigate CVE-2023-32696 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →