CVE-2023-36812
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-36812
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-36812.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-36812
- Aliases
- Related
- Published
- 2023-06-30T23:15:10Z
- Modified
- 2025-09-19T14:32:12.160203Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit
07c4641471cand further refined in commitfa88d3e4b. These patches are available in the2.4.2release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config optiontsd.core.enable_ui = trueand remove the shell filesmygnuplot.batandmygnuplot.sh. - References
-
- https://github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9
- https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba
- https://github.com/OpenTSDB/opentsdb/security/advisories/GHSA-76f7-9v52-v2fw
- http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html
Affected packages
Git / github.com/opentsdb/opentsdb
Affected ranges
- Type
- GIT
- Repo
- https://github.com/opentsdb/opentsdb
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
2.*
2.1.1
v1.*
v1.0.0
v1.1.0
v2.*
v2.0.0
v2.0.0RC1
v2.0.0RC2
v2.0.0RC3
v2.0.1
v2.1.0
v2.1.0RC1
v2.1.0RC2
v2.1.2
v2.1.3
v2.1.4
v2.2.0
v2.2.0RC1
v2.2.0RC2
v2.2.0RC3
v2.2.1
v2.2.2
v2.3.0
v2.3.0RC1
v2.3.0RC2
v2.3.1
v2.3.2
v2.4.0
v2.4.0RC2
v2.4.1
Database specific
{
"vanir_signatures": [
{
"id": "CVE-2023-36812-02f50aa3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"285202655282756513307212215982219689355",
"244800964684257996843248949425225681164",
"219078161650577279921772228174824557290",
"22044013831201765401686392379959509243",
"215587230347243490744611364667676837975",
"29174065763775148327177767930584572798",
"8049774749977460216726574016028368222",
"201965185109804557666128046412361707437",
"77199835893924967166776717566267447442",
"159211164572169532757118555248200119338",
"254810970286137399730375470287438578764",
"253874946323839971712491433181564066792",
"206853622386607824545630016406107546448",
"55865028367236032398933663795090234177",
"52689202939698420593857978878100276494",
"304011581363000454509777055364975819417",
"65685398694743008221281464335396866482",
"206402944901338814905241992855999615518",
"258809562578289227315481029373648222475",
"44514728979303328440103490280077472626",
"198128856343668079525482667279868769269",
"275374281438835549068180158911912243738",
"167605360563319658355033064687059274159",
"238668373690910294252642542611808481665",
"12901879534002328549349611597414166990",
"117823180168229884414646346893680578598",
"92363071733549284495244828539930632071",
"16578065039662660745068718450498286348",
"335390060638516215661893390174505684444",
"158844076480539371570799654643504590097",
"126764741698356993348869696845360990137",
"264329965830401965480588779846327060555",
"11658199455804319490807989647984921787",
"38603791682005797835653765712578831525",
"202387206219448401306550762048190039476",
"201838894367636382228532839532654797685",
"327818240365928256701379127135245120544",
"255532338120353862517737180185153967823",
"114088867515209568476613314276962888597",
"314123526266895566843748524485136622657",
"227467890341885814197688077652126606306"
]
},
"signature_type": "Line",
"target": {
"file": "test/tsd/TestGraphHandler.java"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-23c9254f",
"digest": {
"length": 419.0,
"function_hash": "21754829914766377546711673879702972947"
},
"signature_type": "Function",
"target": {
"file": "test/tsd/TestGraphHandler.java",
"function": "setColorParams"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-43041398",
"digest": {
"length": 1025.0,
"function_hash": "27077658475689427864114023710442145232"
},
"signature_type": "Function",
"target": {
"file": "src/tsd/GraphHandler.java",
"function": "setPlotDimensions"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-4fe079cd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"264051637920165470388469687109506848937",
"194693718344945341063401059045885035198",
"249794771533729342001205197609228904012",
"194063691775372249279401498310218264111",
"174624925070500561395114778698821563899",
"296904470637393212012488041934032554613",
"8517316072420935692389666635541489908",
"311198637783724423561459442912919492469",
"79537736603349184880819695059537653570",
"203904963847569766571486068741684045827",
"79862756005635048796563360613357018319",
"234965298343419926973768026606369407850",
"176606191003893997169526838350133997157",
"333171026834290007105922263582887093747",
"52184209272142307415358449636516934299",
"110459351960663457487790672482860272416",
"134514544486965743150110695167775596980",
"144830052858107903001580396516571553861",
"114854159445608463982587929414118835811"
]
},
"signature_type": "Line",
"target": {
"file": "src/tsd/HttpQuery.java"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba"
},
{
"id": "CVE-2023-36812-5288495b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"282218780449616240821229740485716568729",
"276502175418169904001576021257269887381",
"126967492264308522395216210792490365181",
"236505796892167241472735142811652978087",
"42671112636517165908345155773303648825",
"274484958069145634558957689981810700221",
"82121854218539297564754959716754191984",
"313318846609669917121214104529703936673",
"80019184508868751185173908392496836890",
"32252142403705032340977218010810361191",
"333283890091121713700008891827109575361",
"164457740080635168716048355119344584695",
"8181913099440605734563125047045734456",
"111560060589432318692303324954114579111",
"240662222128014205731427491240987574858",
"67759784071545677119407193595107933238",
"278556178063019472374121721906644124097",
"216273379001448334120392093971080334707",
"174814644730524252735419170347979465960",
"333971804004295962420211788590307626329",
"324531774824290241695900830146189407082",
"323116654415399401040672042826272340604",
"152485557191326442582651824272901723633",
"184571356151611760286703706278101361798",
"55785108733464890834786319832684984952",
"77300940614840504226053351144517285841",
"172422398475649872377833229864496672243",
"238448356077911994143773187290029835774",
"37831769799356177377256921317323742174",
"195461172629765935098269454255736169012",
"19203291509656366273313449397526695263",
"240833663108843680457345694281267956175",
"73948075097641137535104619717812461837",
"33691207340390175259347838707820928134",
"201797979185516883033827145139936138900",
"170541490996032751232472572087321972099",
"13211921586949809323897091523229955346",
"196232003687109746834311757665501727204",
"135265267844498773803719850183808286283",
"38353040625896941971818209364478713200",
"325111488902486654914598351215336291953",
"231237313527770099621973640292070883134",
"275252776310866446950135073268259161467",
"208288704984503080233011385452908576945",
"337944540852088052410407699421762037023",
"190990492101487600901410772369890457125",
"14098171808583486733876279613303791796",
"195301944416269462853780404757228695331",
"189583983178865158766986056974937056333",
"116432609072707566496166516295592413268",
"307109771444463732055575426206165216744",
"238846974536083295414966100026475702435",
"324534364065091361524854944283415155598",
"246330869647463891907945026027374216790",
"77344423834517056445242611975876934304",
"215634524385136322730926037608717011854",
"208618839460857847051641235199855252606",
"316207394798350820713767141655140408653",
"41204392788121509581866538743853768386",
"114342185068482704857817357149808424408",
"196975052337040237893094386621845906121",
"253422688565920648447780634000332304683",
"186010156314907406463865252719555026504",
"111399174515101782173947878955312386812",
"25414882461940840742087332158164176518",
"196506656092119566691740203254683733242",
"321068784262949843099676780728353295035",
"20852327650146862062907274613158026335"
]
},
"signature_type": "Line",
"target": {
"file": "src/tsd/GraphHandler.java"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-5617cc5d",
"digest": {
"length": 552.0,
"function_hash": "10262682517849209759710316944765240038"
},
"signature_type": "Function",
"target": {
"file": "test/tsd/TestGraphHandler.java",
"function": "setSmoothParams"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-7725a144",
"digest": {
"length": 1025.0,
"function_hash": "303583127088162215664436438165782077877"
},
"signature_type": "Function",
"target": {
"file": "src/tsd/HttpQuery.java",
"function": "internalError"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba"
},
{
"id": "CVE-2023-36812-b29a8539",
"digest": {
"threshold": 0.9,
"line_hashes": [
"296611036381030638682429294095846790401",
"329408185650132167798941418402631149045",
"289451997690361157119423739586646468331",
"35587530887446325263204751996200074112",
"296611036381030638682429294095846790401",
"329408185650132167798941418402631149045",
"289451997690361157119423739586646468331",
"194077103581407549244544965984008630883"
]
},
"signature_type": "Line",
"target": {
"file": "test/tsd/TestQueryRpc.java"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba"
},
{
"id": "CVE-2023-36812-ccac0647",
"digest": {
"length": 261.0,
"function_hash": "139151306512976608862140524397689000129"
},
"signature_type": "Function",
"target": {
"file": "test/tsd/TestGraphHandler.java",
"function": "setLabelParams"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-cccf2e76",
"digest": {
"length": 678.0,
"function_hash": "232233079236879369671876382984267413639"
},
"signature_type": "Function",
"target": {
"file": "test/tsd/TestQueryRpc.java",
"function": "executeNSU"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba"
},
{
"id": "CVE-2023-36812-d2209620",
"digest": {
"length": 912.0,
"function_hash": "84255967637691111234381416621389283879"
},
"signature_type": "Function",
"target": {
"file": "src/tsd/HttpQuery.java",
"function": "badRequest"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba"
},
{
"id": "CVE-2023-36812-d7919627",
"digest": {
"length": 3945.0,
"function_hash": "175099909058282180819932364194410164631"
},
"signature_type": "Function",
"target": {
"file": "src/tsd/GraphHandler.java",
"function": "setPlotParams"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-d80eed02",
"digest": {
"length": 1151.0,
"function_hash": "220455661772262214829259422726919623161"
},
"signature_type": "Function",
"target": {
"file": "test/tsd/TestGraphHandler.java",
"function": "setYRangeParams"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-da2819ba",
"digest": {
"length": 360.0,
"function_hash": "170049736537727174186095198654561505063"
},
"signature_type": "Function",
"target": {
"file": "test/tsd/TestGraphHandler.java",
"function": "setKeyParams"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-e2e1d5d4",
"digest": {
"length": 227.0,
"function_hash": "115953092585376297506831464315042248890"
},
"signature_type": "Function",
"target": {
"file": "test/tsd/TestGraphHandler.java",
"function": "setStyleParams"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-f9a58d0b",
"digest": {
"length": 358.0,
"function_hash": "204393985823783998998801262485102761910"
},
"signature_type": "Function",
"target": {
"file": "test/tsd/TestGraphHandler.java",
"function": "setFormatParams"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"
},
{
"id": "CVE-2023-36812-fe4a3fce",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133055113987216306629635457172086281959",
"318249663440861099704938746935406624271",
"35919350242276400757561628451073766767",
"233258021618676197940889644044378508100",
"133055113987216306629635457172086281959",
"318249663440861099704938746935406624271",
"233838425573375376779338654687688386847",
"98557901631851644301013118807935548226"
]
},
"signature_type": "Line",
"target": {
"file": "test/tsd/TestHttpQuery.java"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba"
},
{
"id": "CVE-2023-36812-feafd4cd",
"digest": {
"length": 796.0,
"function_hash": "168576425543258222220647695343962120943"
},
"signature_type": "Function",
"target": {
"file": "test/tsd/TestQueryRpc.java",
"function": "postQueryNoMetricBadRequest"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba"
}
]
}