CVE-2024-3250
Assigner: canonical
Published: 2024-04-04T14:29:31.250Z
State: PUBLISHED
affected: packageName: pebble
product: Pebble
vendor: Canonical Ltd.
repo: https://github.com/canonical/pebble
platforms: Linux
versions: lessThan: v1.10.2
status: affected
version: 0
versionType: semver
descriptions: value: It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2, and v1.7.4.
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
credits: value: Harry Pidcock
type: finder
value: Ben Hoyt
type: finder
value: Ben Hoyt
type: remediation developer