PT-2020-18347 · Nethack Devteam · Nethack

Nhkeni · Publicado 2020-03-10 · Atualizado 2025-03-16 · CVE-2020-5253

Positive Technologies (AI Summary) · Pt

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nome do software vulnerável e versões afetadas

Versões do NetHack anteriores à 3.6.0

Descrição

A vulnerabilidade permite o uso malicioso de caracteres de escape no arquivo de configuração, geralmente o .nethackrc, o que poderia ser explorado.

Recomendações

Para versões anteriores à 3.6.0, atualize para o NetHack 3.6.0 para resolver o problema.

Correção

Incomplete List of Disallowed Inputs

Improper Privilege Management

Enumeração de Fraquezas

CWE-184

CWE-269

Identificadores relacionados

CVE-2020-5253

GHSA-2C7P-3FJ4-223M

OPENSUSE-SU-2025:14898-1

Produtos afetados

Nethack

Referências · 14

• https://github.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223m · Nota
• https://github.com/NetHack/NetHack/commits/612755bfb5c412079795c68ba392df5d93874ed8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2020-5253 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2020-5253 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/ZXWYIIFE7GQMOSGULGWD55HZTUENYTOP · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-5253 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2025:14898-1 · Aviso do Fabricante
• https://t.me/cvenotify/1474 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2020-5253 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2020-5253 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2020-5253 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-5253 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-5253 · Aviso do Fabricante
• https://nethack.org/security/CVE-2020-5253.html · Nota