PT-2023-16918 · Liferea+2 · Liferea+2

Lwindolf · Published 2023-03-11 · Updated 2024-05-17 · CVE-2023-1350

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions liferea (affected versions not specified)

Description A critical issue has been found, affecting the function update job run of the file src/update.c in the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. This issue can be exploited remotely.

Recommendations To fix this issue, it is recommended to apply a patch. Specifically, the patch named 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59 should be applied. As a temporary workaround, consider disabling the update job run function until a patch is available. Additionally, if "Extract full content from HTML5 and Google AMP" has been enabled for one or more feed subscriptions, it is recommended to restrict this feature to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2023-1428

ALT-PU-2023-1886

ALT-PU-2023-4511

CVE-2023-1350

MGASA-2023-0103

OPENSUSE-SU-2023:0096-1

OPENSUSE-SU-2024:12783-1

Affected Products

Alt Linux

Debian

Liferea

References · 28

• https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-1350 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-1886 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1350 · Security Note
• https://ubuntu.com/security/CVE-2023-1350 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-4511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1350 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1350 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0103 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0103.html · Security Note
• https://errata.altlinux.org/ALT-PU-2023-1428 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1350 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1350 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/liferea · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0096-1 · Vendor Advisory