| Package | Affected versions | Patched versions |
|---|---|---|
| pi-hole | ≥ 6.0, < 6.4.3 | 6.4.3 |
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free