CVE-2023-32696

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.9.9 CKAN versions prior to 2.10.1

Description CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the ckan user, equivalent to www-data, owned code and configuration files in the docker container and had permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available.

Recommendations For versions prior to 2.9.9, update to version 2.9.9 or later. For versions prior to 2.10.1, update to version 2.10.1 or later.