Mock: privilege escalation for users that can access mock configuration

CVE-2023-6395

Summary

The Mock software is vulnerable to privilege escalation attacks due to insufficient sandboxing mechanisms during the expansion and execution of Jinja2 templates. This vulnerability allows less privileged users, who may inadvertently gain control over configuration parameters, to execute arbitrary code with root privileges on the build server. The implications of this vulnerability are serious, as attackers could exploit improper settings to bypass security measures, leading to systemic risks within affected build environments. As documented in the relevant sources, users added to the mock group are treated as privileged, but the execution context can lead to unintended vulnerabilities when integrating external templates.

References