What is GHSA-7c44-7j7v-w554?

GHSA-7c44-7j7v-w554 is a security advisory published by GitHub Security Advisories with High severity. Buildkite Elastic CI for AWS symbolic link following vulnerability

Which CVE IDs does GHSA-7c44-7j7v-w554 cover?

GHSA-7c44-7j7v-w554 covers the following CVE IDs: CVE-2023-43116. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7c44-7j7v-w554?

GHSA-7c44-7j7v-w554 has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-7c44-7j7v-w554?

GHSA-7c44-7j7v-w554 affects 1 product, including: go/github.com/buildkite/elastic-ci-stack-for-aws/v6:\u003c 6.7.0.

GHSA-7c44-7j7v-w554HighCVSS 7.8

Buildkite Elastic CI for AWS symbolic link following vulnerability

Vendor

GitHub Security Advisories

Published

December 22, 2023

Last Modified

January 3, 2024

🔗 CVE IDs covered (1)

CVE-2023-43116 →

📋 Description

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.

🎯 Affected products1

go/github.com/buildkite/elastic-ci-stack-for-aws/v6:< 6.7.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-43116
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md
https://github.com/buildkite/elastic-ci-stack-for-aws/commit/8f79882b6aa18fb8fc61f10c7047d2907b7a2f69
https://github.com/advisories/GHSA-7c44-7j7v-w554