Description
It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2, and v1.7.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | Pebble | < v1.10.2 | v1.10.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/canonical/pebble | >= 1.2.0, < 1.4.2 | 1.4.2 | GHSA-4685-2x5r-65pj |
| Go | github.com/canonical/pebble | >= 1.5.0, < 1.7.3 | 1.7.3 | GHSA-4685-2x5r-65pj |
| Go | github.com/canonical/pebble | >= 1.8.0, < 1.10.2 | 1.10.2 | GHSA-4685-2x5r-65pj |
| Go | github.com/canonical/pebble | < 1.1.1 | 1.1.1 | GHSA-4685-2x5r-65pj |
| Go | github.com/canonical/pebble | < 1.1.1 · >= 1.2.0, < 1.4.2 · >= 1.5.0, < 1.7.3 · >= 1.8.0, < 1.10.2 | 1.1.1, 1.4.2, 1.7.3, 1.10.2 | GO-2024-2692 |
References
- https://www.cve.org/CVERecord?id=CVE-2024-3250 issue-tracking
- https://github.com/canonical/pebble/security/advisories/GHSA-4685-2x5r-65pj issue-tracking