Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file.
An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process.
Solution:
1. upgrade to bRPC >= 1.5.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/
2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2218 https://github.com/apache/brpc/pull/2218
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/05/08/1 | Mailing List Patch Third Party Advisory |
| https://lists.apache.org/thread/jqpttrqbc38yhckgp67xk399hqxnz7jn | Mailing List Patch Vendor Advisory |
Configurations
History
12 May 2023, 02:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://lists.apache.org/thread/jqpttrqbc38yhckgp67xk399hqxnz7jn - Mailing List, Patch, Vendor Advisory | |
| References | (MISC) http://www.openwall.com/lists/oss-security/2023/05/08/1 - Mailing List, Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:* | |
| First Time |
Apache brpc
Apache |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
08 May 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 May 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-08 09:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-31039
Mitre link : CVE-2023-31039
CVE.ORG link : CVE-2023-31039
JSON object : View
Products Affected
apache
- brpc
CWE
CWE-20
Improper Input Validation