Lucene search

[email protected]NVD:CVE-2023-34112

HistoryJun 09, 2023 - 12:15 a.m.

CVE-2023-34112

2023-06-0900:15:10

CWE-94

[email protected]

web.nvd.nist.gov

cve-2023-34112

javacpp presets

native c++ libraries

command injection vulnerability

github event

head commit message

string interpolation

version 1.5.9

upgrade

security advisory

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

43.7%

JSON

JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the bytedeco/javacpp-presets use the github.event.head_commit.message parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.

Affected configurations

Nvd

Node

bytedecojavacpp_presetsRange<1.5.9

VendorProductVersionCPE
bytedecojavacpp_presets*cpe:2.3:a:bytedeco:javacpp_presets:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bytedeco	javacpp_presets	*	cpe:2.3:a:bytedeco:javacpp_presets::::::::

References

github.com/bytedeco/javacpp-presets/security/advisories/GHSA-36rx-hq22-jm5x

securitylab.github.com/research/github-actions-untrusted-input/

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

43.7%

JSON

Related for NVD:CVE-2023-34112

cvelist1 cve1 osv1 prion1