Mock: privilege escalation for users that can access mock configuration

CVE-2023-6395

What is CVE-2023-6395?

The Mock software is vulnerable to privilege escalation attacks due to insufficient sandboxing mechanisms during the expansion and execution of Jinja2 templates. This vulnerability allows less privileged users, who may inadvertently gain control over configuration parameters, to execute arbitrary code with root privileges on the build server. The implications of this vulnerability are serious, as attackers could exploit improper settings to bypass security measures, leading to systemic risks within affected build environments. As documented in the relevant sources, users added to the mock group are treated as privileged, but the execution context can lead to unintended vulnerabilities when integrating external templates.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References