CVE-2023-1350
- Source
- https://cve.org/CVERecord?id=CVE-2023-1350
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1350.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-1350
- Downstream
DEBIAN (1)
MGASA (1)
openSUSE (2)
UBUNTU (1)
- Related
- Published
- 2023-03-11T08:20:34Z
- Modified
- 2026-10-21T08:29:54Z
- Severity
-
- 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- liferea Feed Enrichment update.c update_job_run os command injection
- Details
-
A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-78" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1350.json" }- References
Affected packages
Git / github.com/lwindolf/liferea
Affected ranges
- Type
- GIT
- Repo
- https://github.com/lwindolf/liferea
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.12.0" }, { "last_affected": "1.12.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.12.1" }, { "last_affected": "1.12.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.12.2" }, { "last_affected": "1.12.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.12.3" }, { "last_affected": "1.12.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.12.4" }, { "last_affected": "1.12.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.12.5" }, { "last_affected": "1.12.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.12.6" }, { "last_affected": "1.12.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.12.7" }, { "last_affected": "1.12.7" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.12.8" }, { "last_affected": "1.12.8" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.12.9" }, { "last_affected": "1.12.9" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.0" }, { "last_affected": "1.13.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.1" }, { "last_affected": "1.13.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.2" }, { "last_affected": "1.13.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.3" }, { "last_affected": "1.13.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.4" }, { "last_affected": "1.13.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.5" }, { "last_affected": "1.13.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.6" }, { "last_affected": "1.13.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.7" }, { "last_affected": "1.13.7" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.8" }, { "last_affected": "1.13.8" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.13.9" }, { "last_affected": "1.13.9" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.14-RC1" }, { "last_affected": "1.14-RC1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.14-RC2" }, { "last_affected": "1.14-RC2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.14-RC3" }, { "last_affected": "1.14-RC3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "1.14.0" }, { "last_affected": "1.14.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
1.*
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.13.7
1.13.8
1.13.9
1.14-RC1
1.14-RC2
1.14-RC3
1.14.0
v1.*
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.6
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.13.5
v1.13.6
v1.13.7
v1.13.8
v1.13.9
v1.14-RC1
v1.14-RC2
v1.14-RC3
v1.14.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1350.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "229604254238680172632365617693387942341",
"length": 876
},
"id": "CVE-2023-1350-0d85bf12",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59",
"target": {
"file": "src/subscription.c",
"function": "subscription_update"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"243303897905939856965576911987003859110",
"93647419397656489060880212003295490315",
"20726456570420313058966719183885596138",
"224998958810073265903190603839020589585",
"24580736861864256127819184505257012930",
"201022164368684001516330873482138418325",
"13465563959931164650795944966543081898",
"168702899020404082193037640559252184869"
],
"threshold": 0.9
},
"id": "CVE-2023-1350-3699a79b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59",
"target": {
"file": "src/update.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"67509552097405408901168130818204326250",
"91721631201113856327780823692618426635",
"302319106777376540887581050492021927387",
"4863750628444328116162721014498465649",
"41055154291194317571664876982920228082",
"186656453080060791443011527196072175584",
"173279506877094234981724801920888522092"
],
"threshold": 0.9
},
"id": "CVE-2023-1350-89c72ade",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59",
"target": {
"file": "src/update.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "149372325487653056207209293357032933976",
"length": 479
},
"id": "CVE-2023-1350-98a538fb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59",
"target": {
"file": "src/update.c",
"function": "update_job_run"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"111402719213714351279035381627062209777",
"79725955593806268185032075555497764929",
"282552982833084115167591563273749764852",
"19133636881077950551283322876732034245"
],
"threshold": 0.9
},
"id": "CVE-2023-1350-c39417fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59",
"target": {
"file": "src/subscription.c"
}
}
]
vanir_signatures_modified
"2026-10-21T08:29:54Z"