GHSA-jv3f-7m33-qp65

Source

https://github.com/advisories/GHSA-jv3f-7m33-qp65

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-jv3f-7m33-qp65/GHSA-jv3f-7m33-qp65.json

Aliases

• CVE-2023-33955

Published

2023-05-26T13:57:27Z

Modified

2023-11-08T04:12:42.710587Z

Details

Impact

Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename.

Reported-By

Thanks to the report from Mio Li wulilixi1@gmail.com

Patches

commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60
Author: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>
Date:   Tue May 23 08:47:12 2023 -0700

    Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)

    Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>

Workarounds

Workarounds are to remove the concerned file and rewrite it properly with the right file and extensions. Avoid using RTLO characters in your filenames.

References

• https://github.com/minio/console/security/advisories/GHSA-jv3f-7m33-qp65
• https://nvd.nist.gov/vuln/detail/CVE-2023-33955
• https://github.com/minio/console/commit/17e791afb90c9ad27c65f63c6be14f2f6a3a9d60
• https://github.com/minio/console
• https://github.com/minio/console/releases/tag/v0.28.0