PT-2023-26807 · Conemu · Conemu

Maximus5 · Published 2023-09-12 · Updated 2023-10-05 · CVE-2023-39150

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConEmu versions prior to commit 230724

Description The issue is related to the incorrect sanitization of title responses for control characters, potentially leading to arbitrary code execution. This is connected to an incomplete fix for a previous issue.

Recommendations For ConEmu versions prior to commit 230724, update to a version that includes the commit 230724 or later to resolve the issue. As a temporary workaround, consider disabling the handling of title responses until a patch is available. Restrict access to potentially vulnerable features to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2023-39150

Affected Products

Conemu

References · 7

• https://github.com/Maximus5/ConEmu/commit/60683a186628ffaa7689fcb64b3c38ced69287c1 · Patch
• https://osv.dev/vulnerability/CVE-2023-39150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39150 · Security Note
• https://twitter.com/CVEnew/status/1701573426698211480 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1701606862498714057 · Twitter Post
• https://gist.github.com/dgl/081cf503dc635df39d844e058a6d4c88 · Note
• https://t.me/cibsecurity/70279 · Telegram Post