{"id":"GHSA-vfxf-76hv-v4w4","summary":"Withdrawn Advisory: User-provided environment values allow execution on macOS agents","details":"## Withdrawn Advisory\nThis advisory has been withdrawn because the vulnerability affects a binary, not a library in a [supported ecosystem](https://github.com/github/advisory-database#supported-ecosystems). Therefore, users of the library should not receive alerts. This link is maintained to preserve external references.\n\n## Original Description\n\n### Impact\nAgents running on macOS could be susceptible to unexpected code execution through user supplied environment variables.\n\n### Patches\nFixed in versions 14.2.4, 13.4.13 and 12.4.31.\n\n### References\n* Fix PR: https://github.com/gravitational/teleport/pull/36132\n","modified":"2024-09-06T21:40:14Z","published":"2024-01-03T21:30:17Z","withdrawn":"2024-01-23T12:49:53Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2024-01-03T21:30:17Z"},"references":[{"type":"WEB","url":"https://github.com/gravitational/teleport/security/advisories/GHSA-vfxf-76hv-v4w4"},{"type":"WEB","url":"https://github.com/gravitational/teleport/pull/36132"},{"type":"WEB","url":"https://github.com/gravitational/teleport/commit/fcc97de9f99dfec8696ecfd620672a26f29cf9ac"},{"type":"PACKAGE","url":"https://github.com/gravitational/teleport"}],"affected":[{"package":{"name":"github.com/gravitational/teleport","ecosystem":"Go","purl":"pkg:golang/github.com/gravitational/teleport"},"ranges":[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.2.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-vfxf-76hv-v4w4/GHSA-vfxf-76hv-v4w4.json"}},{"package":{"name":"github.com/gravitational/teleport","ecosystem":"Go","purl":"pkg:golang/github.com/gravitational/teleport"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"13.4.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-vfxf-76hv-v4w4/GHSA-vfxf-76hv-v4w4.json"}},{"package":{"name":"github.com/gravitational/teleport","ecosystem":"Go","purl":"pkg:golang/github.com/gravitational/teleport"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"12.4.31"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-vfxf-76hv-v4w4/GHSA-vfxf-76hv-v4w4.json"}}],"schema_version":"1.9.0"}