Vulnerability Details CVE-2023-31039
Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file.
An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process.
Solution:
1. upgrade to bRPC >= 1.5.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/
2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2218 https://github.com/apache/brpc/pull/2218
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 46.9%
CVSS Severity
CVSS v3 Score 9.8
References
Products affected by CVE-2023-31039
-
cpe:2.3:a:apache:brpc:0.9.0
-
cpe:2.3:a:apache:brpc:0.9.5
-
cpe:2.3:a:apache:brpc:0.9.6
-
cpe:2.3:a:apache:brpc:0.9.7
-
cpe:2.3:a:apache:brpc:0.9.8
-
cpe:2.3:a:apache:brpc:1.0.0
-
cpe:2.3:a:apache:brpc:1.0.1
-
cpe:2.3:a:apache:brpc:1.1.0
-
cpe:2.3:a:apache:brpc:1.2.0
-
cpe:2.3:a:apache:brpc:1.3.0
-
cpe:2.3:a:apache:brpc:1.4.0