Remote Code Execution for 2.4.1 and earlier

CRITICAL 9.8CVE-2023-36812 · GHSA-76f7-9v52-v2fw · Published 30/06/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
net.opentsdb:opentsdb Maven	`< 2.4.2`	`2.4.2`
opentsdb opentsdb	`< 2.4.2`	`2.4.2`

Description

Impact

OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration.

Patches

Patched in 07c4641471c6f5c2ab5aab615969e97211eb50d9 and further refined in https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba

Workarounds

Disable Gunuplot via tsd.core.enable_ui = true and remove the shell files https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.bat and https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.sh.

NVD description

OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.

References

OpenTSDB/opentsdb security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-36812 · ADVISORY
OpenTSDB/opentsdb commit 07c4641 · WEB
OpenTSDB/opentsdb commit fa88d3e · WEB
OpenTSDB/opentsdb · PACKAGE
packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free