id: PYSEC-2024-248
modified: 2025-05-16T14:23:05.150356Z
published: 2024-10-14T21:15:12Z
aliases:
- CVE-2024-48911
- GHSA-pf5v-pqfv-x8jj
details: OpenCanary, a multi-protocol network honeypot, directly executed commands
  taken from its config file. Prior to version 0.9.4, where the config file is stored
  in an unprivileged user directory but the daemon is executed by root, it’s possible
  for the unprivileged user to change the config file and escalate permissions when
  root later runs the daemon. Version 0.9.4 contains a fix for the issue.
affected:
- package:
    ecosystem: PyPI
    name: opencanary
    purl: pkg:pypi/opencanary
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.9.4
  versions:
  - "0.2"
  - "0.3"
  - 0.3.1
  - 0.3.2
  - "0.4"
  - "0.5"
  - 0.5.1
  - 0.5.2
  - 0.5.4
  - 0.5.5
  - 0.5.6
  - 0.5.7
  - 0.5.8
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.7.1
  - 0.9.0
  - 0.9.1
  - 0.9.2
  - 0.9.3
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
references:
- type: ADVISORY
  url: https://github.com/thinkst/opencanary/security/advisories/GHSA-pf5v-pqfv-x8jj
- type: FIX
  url: https://github.com/thinkst/opencanary/commit/2c11575b1a3dd8b0df26a879ba856c0aa350c049
- type: WEB
  url: https://github.com/thinkst/opencanary/releases/tag/v0.9.4