Go/github.com/goreleaser/nfpm/v2 CVE-2023-32698: high 7.1, EPSS 0.38%

nfpm has incorrect default permissions

Action: Upgrade github.com/goreleaser/nfpm/v2 to 2.29.0 or later.

go get github.com/goreleaser/nfpm/v2@v2.29.0

Affected

Fixed versions

Sources

• osv: GHSA-w7jw-q4fg-qc4c
• https://github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4c
• https://nvd.nist.gov/vuln/detail/CVE-2023-32698
• https://github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30
• https://github.com/goreleaser/nfpm
• https://github.com/goreleaser/nfpm/releases/tag/v2.29.0

CVE-2023-32698 · published 2023-05-24T17:30:16Z · modified 2026-08-07T08:12:17.927581376Z · JSON