CVE-2024-34528

Advisory

Affected versions of Wordops are vulnerable to TOCTOU (Time-of-Check to Time-of-Use) race condition in `wo/cli/plugins/stack_pref.py`. This vulnerability occurred because the 'os.open' call did not use a mode parameter during file creation.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Remove php72 and php73 stacks
- All APT repositories are properly signed with gpg keys
- Netdata is installed from debian packages when available
- Less logs in acme.sh operation
- Migrate all repositories in /etc/apt/sources.list.d/wo-repo.list in indivual files like mariadb.list, redis.list, wordops.list

Fixed

- wo info php versions display
- Repositories's gpg keys are not managed with apt-key anymore
- `wo site update site.tld --hsts` errors
- `wo site update site.tld --ngxblocker` errors
- Netdata install and upgrade
- 22222 Backend not secure with valid SSL certificate

Security

- Fix [CVE-2024-34528](https://github.com/advisories/GHSA-23qq-p4gq-gc2g)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34528
• https://github.com/WordOps/WordOps/commit/31353f0fef14ad8bc1f61c028971bd30b9e1909b