Lucene search

GitHub_MCVE-2023-34112

HistoryJun 09, 2023 - 12:15 a.m.

CVE-2023-34112

2023-06-0900:15:10

CWE-94

GitHub_M

web.nvd.nist.gov

cve-2023-34112

javacpp presets

command injection

github

security

vulnerability

update

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

43.7%

JSON

JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the bytedeco/javacpp-presets use the github.event.head_commit.message parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.

Affected configurations

Nvd

Vulners

Node

bytedecojavacpp_presetsRange<1.5.9

VendorProductVersionCPE
bytedecojavacpp_presets*cpe:2.3:a:bytedeco:javacpp_presets:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bytedeco	javacpp_presets	*	cpe:2.3:a:bytedeco:javacpp_presets::::::::

CNA Affected

[
  {
    "vendor": "bytedeco",
    "product": "javacpp-presets",
    "versions": [
      {
        "version": "< 1.5.9",
        "status": "affected"
      }
    ]
  }
]

References

github.com/bytedeco/javacpp-presets/security/advisories/GHSA-36rx-hq22-jm5x

securitylab.github.com/research/github-actions-untrusted-input/

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

43.7%

JSON

Related for CVE-2023-34112