Excessive permissions for ckan user

CVE-2023-32696

Summary

Prior to versions 2.9.9 and 2.10.1, the CKAN open-source data management system had security vulnerabilities that allowed the 'ckan' user, which operated with elevated privileges and had ownership of critical configuration files, to execute arbitrary code or escalate privileges under certain conditions. If certain flaws existed that permitted arbitrary file writing, an attacker could exploit these issues for malicious purposes. The vulnerabilities were addressed in CKAN version updates 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev, which implemented essential patches to enhance security.

References