id: GO-2023-1788
modules:
    - module: github.com/goreleaser/nfpm/v2
      versions:
        - introduced: 2.0.0
          fixed: 2.29.0
      vulnerable_at: 2.28.0
      packages:
        - package: github.com/goreleaser/nfpm/v2
          symbols:
            - ParseWithEnvMapping
            - WithDefaults
          derived_symbols:
            - Config.Validate
            - Info.Validate
            - Parse
            - ParseFile
            - ParseFileWithEnvMapping
            - PrepareForPackager
            - Validate
        - package: github.com/goreleaser/nfpm/v2/files
          symbols:
            - Content.WithFileInfoDefaults
            - PrepareForPackager
            - addGlobbedFiles
            - addTree
summary: Incorrect permissions in github.com/goreleaser/nfpm/v2
description: |-
    When nfpm packages files without additional configuration to enforce its own
    permissions, the files could be packaged with incorrect permissions (chmod 666
    or 777). Anyone who uses nfpm to create packages and does not check or set file
    permissions before packaging could result in files or folders being packaged
    with incorrect permissions.
cves:
    - CVE-2023-32698
ghsas:
    - GHSA-w7jw-q4fg-qc4c
credits:
    - oCHRISo
    - caarlos0
    - djgilcrease
references:
    - fix: https://github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30
    - web: https://github.com/goreleaser/nfpm/releases/tag/v2.29.0
    - advisory: https://github.com/advisories/GHSA-w7jw-q4fg-qc4c