Threats Tagged 'ghsa-4qqw-wg6j-834r'

OpenLiteSpeed versions before 1.9.3 have a local privilege escalation vulnerability due to a TOCTOU race condition in the admin update script lsup.sh. This script runs update packages from a directory writable by the nobody user without verifying them, allowing an attacker with control over the nobody web process to replace the update package and execute arbitrary code as root during the next update.