PT-2023-28331 · Lol-Html · Lol-Html

Inikulin · Publicado 2023-08-09 · Atualizado 2023-08-22 · CVE-2023-4241

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lol-html versions prior to 1.1.1

Description The issue causes panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.

Recommendations For versions prior to 1.1.1, update to version 1.1.1 to resolve the issue. As a temporary workaround, consider avoiding the processing of arbitrary 3rd party HTML with the library until the update is applied.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-4241

GHSA-C3X7-354F-4P2X

Produtos afetados

Lol-Html

Referências · 9

• https://github.com/cloudflare/lol-html · Nota
• https://github.com/cloudflare/lol-html/security/advisories/GHSA-c3x7-354f-4p2x · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-c3x7-354f-4p2x · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4241 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1691794633448149466 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1691759602549891135 · Publicação no Twitter
• https://t.me/cvenotify/57088 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-4241 · Aviso do Fabricante
• https://t.me/cibsecurity/68629 · Publicação no Telegram