GHSA-r5hg-349q-mg2qHighCVSS 7.0

Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability

Published
December 22, 2023
Last Modified
January 3, 2024

🔗 CVE IDs covered (1)

CVE-2023-43741 →

📋 Description

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.

🎯 Affected products1

  • go/github.com/buildkite/elastic-ci-stack-for-aws/v6:< 6.7.1

🔗 References (4)