Lucene search

TalosCVELIST:CVE-2023-45838

HistoryDec 05, 2023 - 11:30 a.m.

CVE-2023-45838

2023-12-0511:30:10

CWE-494

talos

www.cve.org

buildroot

data integrity

man-in-the-middle

arbitrary command execution

aufs

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

41.4%

JSON

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs package.

CNA Affected

[
  {
    "vendor": "Buildroot",
    "product": "Buildroot",
    "versions": [
      {
        "version": "2023.08.1",
        "status": "affected"
      },
      {
        "version": "dev commit 622698d7847",
        "status": "affected"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2023/12/11/1

talosintelligence.com/vulnerability_reports/TALOS-2023-1844

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

41.4%

JSON

Related for CVELIST:CVE-2023-45838