Vulnerability · Published May 12, 2023 · Assigned by GitHub_M

CVE-2023-32303Planet's secret file is created with excessive permissions

Medium 5.2

In plain English

A medium-severity incorrect permission assignment in planet-client-python from planetlabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.2Medium

Exploit odds (30 days)0.3%top 83.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	planet	2.0.1	GHSA-j5fj-rfh6-qj85
PyPI	planet	2.0.1	PYSEC-2023-71

Affected products (as reported)

Vendor	Product	Versions
planetlabs	planet-client-python	< 2.0.1

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

https://github.com/planetlabs/planet-client-python/security/advisories/GHSA-j5fj-rfh6-qj85 x_refsource_CONFIRM
https://github.com/planetlabs/planet-client-python/commit/d71415a83119c5e89d7b80d5f940d162376ee3b7 x_refsource_MISC
https://github.com/planetlabs/planet-client-python/releases/tag/2.0.1 x_refsource_MISC