Local Privilege Escalation Vulnerability in Hashicorp Packer on Linux
CVE-2022-42717

7.8HIGH

Key Information:

Vendor

Hashicorp
Status
Vagrant
Vendor
CVE Published:
11 October 2022

What is CVE-2022-42717?

An issue in Hashicorp Packer prior to version 2.3.1 allows local privilege escalation through an insecure sudoers configuration for Vagrant on Linux. When a host is set up according to the recommended documentation, non-privileged users may exploit a wildcard in the sudoers file to execute arbitrary commands as the root user. This vulnerability underscores the need for careful review of the sudoers configuration to prevent unauthorized access and control.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/hashicorp/vagrant/pull/12910
https://www.vagrantup.com/docs/synced-folders/nfs
https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.