New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change umask when creating config file to exclude user write (CVE-2024-32233) #4866

Merged

WithoutPants merged 1 commit into stashapp:develop from WithoutPants:config-perm

May 22, 2024

Collaborator

WithoutPants commented May 22, 2024

Changes config.yml permissions to be user and group writable only when creating the file.

Fixes CVE-2024-32233


          Change umask when creating config file to exclude user write

386bbab

WithoutPants added the bug label

WithoutPants added this to the Version 0.26.0 milestone

WithoutPants merged commit 99d9780 into stashapp:develop

2 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment