PT-2023-28882 · Croc · Croc

Matthias Gerstner · Publicado 2023-09-19 · Atualizado 2024-08-21 · CVE-2023-43621

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Croc versions prior to 9.6.16

Description An issue was discovered in Croc where the shared secret, located on a command line, can be read by local users who list all processes and their arguments.

Recommendations For Croc versions prior to 9.6.16, update to version 9.6.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the command line arguments to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2023-43621

GHSA-7G3V-4GGR-XVJF

GO-2023-2069

Produtos afetados

Croc

Referências · 16

• 🔥 https://github.com/schollz/croc/issues/598 · Exploit
• 🔥 https://openwall.com/lists/oss-security/2023/09/08/2 · Exploit
• https://github.com/schollz/croc · Nota
• https://github.com/schollz/croc/commit/863dabb93a271f41b3431c4384357e1856a69533 · Nota
• https://github.com/schollz/croc/pull/701 · Nota
• https://t.me/cibsecurity/70783 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/09/21/5 · Nota
• https://twitter.com/VulmonFeeds/status/1704447515813151140 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-7g3v-4ggr-xvjf · Aviso do Fabricante
• https://github.com/advisories/GHSA-7g3v-4ggr-xvjf · Nota
• https://osv.dev/vulnerability/GO-2023-2069 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-43621 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-43621 · Nota de Segurança
• https://t.me/cvenotify/58359 · Publicação no Telegram
• https://t.me/cvenotify/58133 · Publicação no Telegram