GHSA-jv3f-7m33-qp65
Suggest an improvement- Source
- https://github.com/advisories/GHSA-jv3f-7m33-qp65
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-jv3f-7m33-qp65/GHSA-jv3f-7m33-qp65.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-jv3f-7m33-qp65
- Aliases
- Related
- Published
- 2023-05-26T13:57:27Z
- Modified
- 2023-11-08T04:12:42.710587Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited
- Details
-
Impact
Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename.
Reported-By
Thanks to the report from Mio Li wulilixi1@gmail.com
Patches
commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60 Author: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com> Date: Tue May 23 08:47:12 2023 -0700 Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828) Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>Workarounds
Workarounds are to remove the concerned file and rewrite it properly with the right file and extensions. Avoid using RTLO characters in your filenames.
- Database specific
{ "nvd_published_at": "2023-05-30T07:15:10Z", "cwe_ids": [ "CWE-200" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-05-26T13:57:27Z" }- References
Affected packages
Go / github.com/minio/console
Package
- Name
- github.com/minio/console
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/minio/console