CVE-2023-31039

    Dashboard / Vulnerabilities / CVE-2023-31039

    CVE-2023-31039

    Published: 8 May 2023Last Modified: 12 Aug 2026

    Summary: Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution

    Details: Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process. Solution: 1. upgrade to bRPC >= 1.5.0, download link:  https://dist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch:  https://github.com/apache/brpc/pull/2218 https://github.com/apache/brpc/pull/2218

    References: http://www.openwall.com/lists/oss-security/2023/05/08/1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31039.json, https://lists.apache.org/thread/jqpttrqbc38yhckgp67xk399hqxnz7jn, https://nvd.nist.gov/vuln/detail/CVE-2023-31039

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 06a9cd5526bc38040e1a0adbbdb222ea1c84fb65
    Fixed -8cc57b0c4544900cf91cb3e87451531ebb02f49a

    Affected versions

    1.0.0
    1.0.0-rc02
    1.0.0-rc01

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-31039 | CVE-DB