PT-2017-10763 · Elixir · Elixir Plug

Publicado 2017-07-13 · Atualizado 2022-04-12 · CVE-2017-1000053

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elixir Plug versions prior to 1.0.4 Elixir Plug versions prior to 1.1.7 Elixir Plug versions prior to 1.2.3 Elixir Plug versions prior to 1.3.2

Description The issue concerns arbitrary code execution in the deserialization functions of Plug.Session. The default serialization used by Plug session may result in code execution in certain situations. However, this can only be exploited if the attacker has access to the secret key as well as the signing/encryption salts.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later. For versions prior to 1.1.7, update to version 1.1.7 or later. For versions prior to 1.2.3, update to version 1.2.3 or later. For versions prior to 1.3.2, update to version 1.3.2 or later. As a general precaution, consider changing the secret key base and salts if they are suspected to have been leaked.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-1000053

GHSA-5V4M-C73V-C7GQ

Produtos afetados

Elixir Plug

Referências · 5

• https://github.com/elixir-plug/plug · Nota
• https://elixirforum.com/t/security-releases-for-plug/3913 · Nota
• https://osv.dev/vulnerability/CVE-2017-1000053 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5v4m-c73v-c7gq · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000053 · Nota de Segurança