Package: pigz Version: 2.2.4-1 Severity: serious Tags: security
When asked to compress a file with restricted permissions (like mode 0600), the .gz file pigz creates while doing this has usual mode derived from umask (like 0644). If the file is large enough (and why we would use pigz instead of gzip for small files), this results in the original content being readable for everyone until the compression finishes. Here's the deal: $ fallocate -l 1G foo $ chmod 0600 foo $ pigz foo & $ ls -l foo foo.gz -rw------- 1 mjt mjt 1073741824 Фев 15 12:27 foo -rw-rw-r-- 1 mjt mjt 502516 Фев 15 12:27 foo.gz When it finishes, it correctly applies original file permissions to the newly created file, but it is already waaay too late. Other one-file archivers (gzip, xz, bzip2, ...) usually create the temp file with very strict permissions first, and change it to the right perms only when done, so only the current user can read it. It looks like this bug deserves a CVE#. Thanks, /mjt -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
