Remote Code Execution for 2.4.1 and earlier

NGHIÊM TRỌNG 9.8CVE-2023-36812 · GHSA-76f7-9v52-v2fw · Công bố 30/06/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-36812 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng net.opentsdb:opentsdb, opentsdb (opentsdb).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 16.5%, cao hơn 97.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.4.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
net.opentsdb:opentsdb Maven	`< 2.4.2`	`2.4.2`
opentsdb opentsdb	`< 2.4.2`	`2.4.2`

Mô tả

Impact

OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration.

Patches

Patched in 07c4641471c6f5c2ab5aab615969e97211eb50d9 and further refined in https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba

Workarounds

Disable Gunuplot via tsd.core.enable_ui = true and remove the shell files https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.bat and https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.sh.

Mô tả của NVD

OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.