GHSA-jv3f-7m33-qp65

Suggest an improvement
Source
https://github.com/advisories/GHSA-jv3f-7m33-qp65
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-jv3f-7m33-qp65/GHSA-jv3f-7m33-qp65.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jv3f-7m33-qp65
Aliases
Published
2023-05-26T13:57:27Z
Modified
2023-11-08T04:12:42.710587Z
Severity
  • CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited
Details

Impact

Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename.

Reported-By

Thanks to the report from Mio Li wulilixi1@gmail.com

Patches

commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60
Author: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>
Date:   Tue May 23 08:47:12 2023 -0700

    Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)

    Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>

Workarounds

Workarounds are to remove the concerned file and rewrite it properly with the right file and extensions. Avoid using RTLO characters in your filenames.

References

Affected packages

Go / github.com/minio/console

Package

Name
github.com/minio/console
Purl
pkg:golang/github.com/minio/console

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
0.28.0