PT-2023-26889 · Unknown · Dangerzone

Loweloquence · Published 2023-08-08 · Updated 2023-08-16 · CVE-2023-39342

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dangerzone versions prior to 0.4.2

Description The issue affects the Dangerzone CLI, where output from the container is logged to the user's terminal. If the container is compromised, an attacker may spoof messages in the terminal or change the window title by returning attacker-controlled strings. Additionally, if sanitized files contain ANSI escape sequences, the same issue applies. This issue predominantly affects CLI users, as Dangerzone is mainly a GUI application.

Recommendations For versions prior to 0.4.2, update to version 0.4.2 to resolve the issue. As a temporary workaround, consider avoiding the use of the dangerzone-cli command until the update is applied. Restrict the use of files that may contain ANSI escape sequences to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2023-39342

GHSA-PVWQ-6VPP-2632

Affected Products

Dangerzone

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39342.json · Exploit
• https://github.com/freedomofpress/dangerzone/pull/491 · Vendor Advisory
• https://github.com/freedomofpress/dangerzone/security/advisories/GHSA-pvwq-6vpp-2632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39342 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39342 · Vendor Advisory
• https://github.com/freedomofpress/dangerzone/releases/tag/v0.4.2 · Note
• https://twitter.com/VulmonFeeds/status/1689017082996834305 · Twitter Post