{"id":"CVE-2023-32303","aliases":["GHSA-j5fj-rfh6-qj85","PYSEC-2023-71"],"url":"https://o3.security/vulnerability/CVE-2023-32303","summary":"Planet's secret file is created with excessive permissions","details":"### Impact\nThe secret file stores the user's Planet API authentication information. It should only be accessible by the user, but its permissions allowed the user's group and non-group to read the file as well. \n\n### Validation\nCheck the permissions on the secret file with `ls -l ~/.planet.json` and ensure that they read as `-rw-------`\n\n### Patches\n[d71415a8](https://github.com/planetlabs/planet-client-python/commit/d71415a83119c5e89d7b80d5f940d162376ee3b7)\n\n### Workarounds\nSet the secret file permissions to only user read/write by hand:\n```\nchmod 600 ~/.planet.json\n```\n","published":"2023-05-12T20:55:07.601Z","modified":"2026-10-28T02:31:01.805243066Z","cvss":{"score":5.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"planet","fixedVersion":"2.0.1"}],"fix":{"url":"https://github.com/planetlabs/planet-client-python/commit/d71415a83119c5e89d7b80d5f940d162376ee3b7","label":"planetlabs/planet-client-python@d71415a"},"references":[{"type":"WEB","url":"https://github.com/planetlabs/planet-client-python/releases/tag/2.0.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32303.json"},{"type":"ADVISORY","url":"https://github.com/planetlabs/planet-client-python/security/advisories/GHSA-j5fj-rfh6-qj85"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32303"},{"type":"FIX","url":"https://github.com/planetlabs/planet-client-python/commit/d71415a83119c5e89d7b80d5f940d162376ee3b7"},{"type":"PACKAGE","url":"https://github.com/planetlabs/planet-client-python"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/planet/PYSEC-2023-71.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:01.805243066Z"}}