GitStock

planetlabs/planet-client-python · Security

Planet's secret file is created with excessive permissions

GHSA ID
GHSA-j5fj-rfh6-qj85
CVE ID
CVE-2023-32303
Severity
high
Published
Updated
CVSS
5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v3
5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Description

Impact

The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but its permissions allowed the user's group and non-group to read the file as well.

Validation

Check the permissions on the secret file with ls -l ~/.planet.json and ensure that they read as -rw-------

Patches

d71415a8

Workarounds

Set the secret file permissions to only user read/write by hand:

chmod 600 ~/.planet.json

CWEs

  • CWE-732 · Incorrect Permission Assignment for Critical Resource

References