Mock: privilege escalation for users that can access mock configuration
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja2 templates, which may be included in certain configuration parameters. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | mock | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Fedora | Extra Packages for Enterprise Linux | — | — | No fix listed | CNA |
| Fedora | Fedora | — | — | No fix listed | CNA |
| — | templated_dictionary (PyPI) | before 1.4.1 | 1.4.1 | Patch available | GHSA-7j98-74jh-cjxh |
- mock Vendor— Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Extra Packages for Enterprise Linux VendorFedora Affected — Fixed in — No fix listed CNA
- Fedora VendorFedora Affected — Fixed in — No fix listed CNA
- templated_dictionary (PyPI) Vendor— Affected before 1.4.1 Fixed in 1.4.1 Patch available GHSA-7j98-74jh-cjxh
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rpm-software-management:mock:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | rpm-software-management |
| cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Fedoraproject |
| cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Fedoraproject |
| cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
- cpe:2.3:a:rpm-software-management:mock:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·rpm-software-management
- cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Fedoraproject
- cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Fedoraproject
- cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-7j98-74jh-cjxh templated_dictionary (PyPI) Fixed in 1.4.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Enterprise Linux 6
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6395
- 2026-10-03 Alias added: GHSA-7j98-74jh-cjxh
References
Patch 3
Advisory 3
Other 5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NBFYREAJH4T7GXXQZ4GJEREN4Q3AHS3K/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/62SP2BJC2AFLFJJAEHPGZ3ZINTBTI7AN/
- https://github.com/xsuchy/templated-dictionary
- https://lists.fedoraproject.org/archives/list/[email protected]/message/62SP2BJC2AFLFJJAEHPGZ3ZINTBTI7AN
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NBFYREAJH4T7GXXQZ4GJEREN4Q3AHS3K
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-6395 · CVE Program
- CVE-2023-6395 · NVD
- FIRST EPSS
- GHSA-7j98-74jh-cjxh · GitHub Advisory Database · CC BY 4.0
- CVE-2023-6395 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences