Nixpkgs security tracker
Dismissed
Permalink
CVE-2024-45770
4.4 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse dismissed
Pcp: pmpost symlink attack allows escalating pcp to root user
A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
References
Affected products
pcp
- *
Matching in nixpkgs
pkgs.pcp
Command line peer-to-peer data transfer tool based on libp2p
pkgs.ncmpcpp
Featureful ncurses based MPD client inspired by ncmpc
pkgs.libamqpcpp
Library for communicating with a RabbitMQ server
pkgs.python311Packages.pcpp
C99 preprocessor written in pure Python
pkgs.python312Packages.pcpp
C99 preprocessor written in pure Python
Package maintainers
-
@MikePlayle Mike Playle <mike@mythik.co.uk>
-
@lovek323 Jason O'Conal <jason@oconal.id.au>
-
@k0ral Koral <koral@mailoo.org>
-
@MatthewCroughan Matthew Croughan <matt@croughan.sh>
-
@Rakesh4G Rakesh Gupta <rakeshgupta4u@gmail.com>