PT-2023-26889 · Unknown · Dangerzone

Loweloquence · Publicado 2023-08-08 · Atualizado 2023-08-16 · CVE-2023-39342

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Baixa

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dangerzone versions prior to 0.4.2

Description The issue affects the Dangerzone CLI, where output from the container is logged to the user's terminal. If the container is compromised, an attacker may spoof messages in the terminal or change the window title by returning attacker-controlled strings. Additionally, if sanitized files contain ANSI escape sequences, the same issue applies. This issue predominantly affects CLI users, as Dangerzone is mainly a GUI application.

Recommendations For versions prior to 0.4.2, update to version 0.4.2 to resolve the issue. As a temporary workaround, consider avoiding the use of the dangerzone-cli command until the update is applied. Restrict the use of files that may contain ANSI escape sequences to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-150

Identificadores relacionados

CVE-2023-39342

GHSA-PVWQ-6VPP-2632

Produtos afetados

Dangerzone

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39342.json · Exploit
• https://github.com/freedomofpress/dangerzone/releases/tag/v0.4.2 · Nota
• https://github.com/freedomofpress/dangerzone/pull/491 · Aviso do Fabricante
• https://github.com/freedomofpress/dangerzone/security/advisories/GHSA-pvwq-6vpp-2632 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1689017082996834305 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-39342 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-39342 · Aviso do Fabricante