PT-2023-29959 · Iterm2 · Iterm2

Published 2023-10-22 · Updated 2024-09-11 · CVE-2023-46322

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iTerm2 versions prior to 3.5.0beta12

Description The issue is related to the iTermSessionLauncher.m component in iTerm2, which does not properly sanitize ssh hostnames in URLs. This allows hostnames with non-alphanumeric initial characters and other characters outside the set of alphanumeric characters, dash, and period.

Recommendations For versions prior to 3.5.0beta12, update to version 3.5.0beta12 or later to resolve the issue. As a temporary workaround, consider restricting the use of ssh hostnames with non-standard characters until a patch is applied.

Fix

Weakness Enumeration

CWE-117

Related Identifiers

CVE-2023-46322

Affected Products

Iterm2

References · 7

• https://iterm2.com/downloads.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46322 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46322 · Vendor Advisory
• https://twitter.com/CVEnew/status/1716258907192963136 · Twitter Post
• https://gitlab.com/gnachman/iterm2/-/commit/ef7bb84520013b2524df9787d4aa9f2c96746c01 · Note
• https://t.me/cvenotify/94271 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1716327755866911111 · Twitter Post