Nixpkgs security tracker
Permalink
CVE-2024-45770
4.4 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): NONE
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse dismissed
Pcp: pmpost symlink attack allows escalating pcp to root user
A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
References
Affected products
pcp
- *
Matching in nixpkgs
pkgs.pcp
Command line peer-to-peer data transfer tool based on libp2p
pkgs.ncmpcpp
Featureful ncurses based MPD client inspired by ncmpc
pkgs.libamqpcpp
Library for communicating with a RabbitMQ server
pkgs.python311Packages.pcpp
C99 preprocessor written in pure Python
pkgs.python312Packages.pcpp
C99 preprocessor written in pure Python
Package maintainers
-
@MikePlayle Mike Playle <mike@mythik.co.uk>
-
@lovek323 Jason O'Conal <jason@oconal.id.au>
-
@k0ral Koral <koral@mailoo.org>
-
@MatthewCroughan Matthew Croughan <matt@croughan.sh>
-
@Rakesh4G Rakesh Gupta <rakeshgupta4u@gmail.com>