Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 08 May 2023 03:57:31 +0000
From: Wang Weibing <>
Subject: CVE-2023-31039: Apache bRPC: ServerOptions.pid_file may cause
 arbitrary code execution 

Severity: important

Affected versions:

- Apache bRPC 0.9.0 before 1.5.0


Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file.
An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process.

1. upgrade to bRPC >= 1.5.0, download link: 
2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch:

Required Configurations:

set brpc::ServerOptions::pid_file from user input

Work Arounds:

Apply this patch:


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.