PT-2023-29947 · Calibre+1 · Calibre+1

0X1717 Aka Gyg3S · Publicado 2023-10-22 · Atualizado 2025-02-12 · CVE-2023-46303

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions calibre versions prior to 6.19.0

Description The issue allows adding resources outside of the document root by default, due to the link to local path in ebooks/conversion/plugins/html input.py.

Recommendations For versions prior to 6.19.0, update to version 6.19.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the link to local path function in html input.py to minimize the risk of exploitation.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

ALT-PU-2024-3333

CVE-2023-46303

DLA-3862-1

MGASA-2025-0049

Produtos afetados

Alt Linux

Calibre

Referências · 27

• 🔥 https://github.com/0x1717/ssrf-via-img · Exploit
• https://github.com/kovidgoyal/calibre/compare/v6.18.1...v6.19.0 · Nota
• https://github.com/dwisiswant0/advisory/issues/18 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=33535 · Nota
• https://bugs.launchpad.net/calibre/+bug/1951979 · Nota
• https://osv.dev/vulnerability/CVE-2023-46303 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PTG4W7NKCI3YSS24S3XTWQKFDUAR6BN3 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-3862-1 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2024/09/msg00005.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-46303 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46303 · Nota de Segurança
• https://packages.debian.org/src:calibre · Nota
• https://security-tracker.debian.org/tracker/source-package/calibre · Aviso do Fabricante
• https://t.me/cvenotify/59919 · Publicação no Telegram
• https://t.me/cibsecurity/72744 · Publicação no Telegram