CVE-2022-23653

🗓️ 23 Feb 2022 23:05:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 124 Views🌐 WEB

B2 Command Line Tool key disclosure vulnerability in Linux and Mac v3.2.0 and belo

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2022-23653	24 Feb 202202:13	–	circl
CNNVD	B2_Command_Line_Tool 安全漏洞	23 Feb 202200:00	–	cnnvd
Cvelist	CVE-2022-23653 B2 Command Line Tool TOCTOU application key disclosure	23 Feb 202223:05	–	cvelist
EUVD	EUVD-2022-0029	3 Oct 202520:07	–	euvd
Github Security Blog	B2 Command Line Tool TOCTOU application key disclosure	24 Feb 202213:11	–	github
NVD	CVE-2022-23653	23 Feb 202223:15	–	nvd
OSV	CVE-2022-23653 B2 Command Line Tool TOCTOU application key disclosure	23 Feb 202223:05	–	osv
OSV	GHSA-8WR4-2WM6-W3PR B2 Command Line Tool TOCTOU application key disclosure	24 Feb 202213:11	–	osv
OSV	PYSEC-2022-32	23 Feb 202223:15	–	osv
Prion	Race condition	23 Feb 202223:15	–	prion

NVD

Vulners

Node

backblaze b2_command_line_toolRange≤3.2.0linux

backblaze b2_command_line_toolRange≤3.2.0mac

[
  {
    "product": "B2_Command_Line_Tool",
    "vendor": "Backblaze",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.2.1"
      }
    ]
  }
]

Source	Link
github	www.github.com/Backblaze/B2_Command_Line_Tool/security/advisories/GHSA-8wr4-2wm6-w3pr
github	www.github.com/Backblaze/B2_Command_Line_Tool/commit/c74029f9f75065e8f7e3c3ec8e0a23fb8204feeb

Parameter	Position	Path	Description	CWE
$XDG_CONFIG_HOME/b2/account_info	path	$XDG_CONFIG_HOME/b2/account_info	TOCTOU race condition can expose API keys stored in local config file during creation/permission change.	CWE-367
~/.b2_account_info	path	~/.b2_account_info	TOCTOU race condition can expose API keys stored in local config file during creation/permission change.	CWE-367

21 Nov 2024 06:49Current

4.3Medium risk

Vulners AI Score4.3

CVSS 21.9

CVSS 3.14.7

EPSS0.00038

SSVC

CWE-367