Lucene search

[email protected]NVD:CVE-2023-45842

HistoryDec 05, 2023 - 12:15 p.m.

CVE-2023-45842

2023-12-0512:15:43

CWE-494

[email protected]

web.nvd.nist.gov

cve-2023-45842

buildroot

data integrity

man-in-the-middle

arbitrary command execution

builder

mxsldr package

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

46.6%

JSON

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the mxsldr package.

Affected configurations

Nvd

Node

buildrootbuildrootMatch2023.08.1

VendorProductVersionCPE
buildrootbuildroot2023.08.1cpe:2.3:a:buildroot:buildroot:2023.08.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
buildroot	buildroot	2023.08.1	cpe:2.3:a:buildroot:buildroot:2023.08.1:::::::*

References

www.openwall.com/lists/oss-security/2023/12/11/1

talosintelligence.com/vulnerability_reports/TALOS-2023-1844

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

46.6%

JSON

Related for NVD:CVE-2023-45842

osv1 cve1 prion1 cvelist1 talos1 talosblog1