Arbitrary File Overwrite

🗓️ 29 Sep 2023 08:48:13Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 14 Views

Vulnerability in croc protocol allows arbitrary file overwrit

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2023-43616	20 Sep 202306:15	–	attackerkb
AlpineLinux	CVE-2023-43616	20 Sep 202300:00	–	alpinelinux
Chainguard	CVE-2023-43616 vulnerabilities	21 Mar 202504:12	–	cgr
Circl	CVE-2023-43616	20 Sep 202312:30	–	circl
CNNVD	croc path traversal vulnerability	20 Sep 202300:00	–	cnnvd
CVE	CVE-2023-43616	20 Sep 202300:00	–	cve
Cvelist	CVE-2023-43616	20 Sep 202300:00	–	cvelist
Github Security Blog	Sender can cause a receiver to overwrite files during ZIP extraction in Croc	20 Sep 202306:30	–	github
NVD	CVE-2023-43616	20 Sep 202306:15	–	nvd
OSV	CGA-2W3W-VXPC-RV62	31 Mar 202516:00	–	osv

Vulners

Node

schollz crocMatch9.6.15-r3go

AND

schollz crocMatch9.6.15-r0go

AND

schollz crocMatch9.6.15-r2go

AND

schollz crocMatch10.0.11-r0go

AND

schollz crocMatch9.6.15-r1go

AND

alpinelinux alpine_linuxMatch3.20

OR

schollz crocMatch9.5.0-r1go

AND

schollz crocMatch9.3.0-r1go

AND

schollz crocMatch9.6.4-r1go

AND

schollz crocMatch9.5.3-r1go

AND

schollz crocMatch8.6.10-r0go

AND

schollz crocMatch9.1.4-r0go

AND

schollz crocMatch9.6.5-r4go

AND

schollz crocMatch9.6.15-r2go

AND

schollz crocMatch9.5.1-r0go

AND

schollz crocMatch9.6.0-r3go

AND

schollz crocMatch9.5.2-r0go

AND

schollz crocMatch9.1.4-r1go

AND

schollz crocMatch9.6.1-r2go

AND

schollz crocMatch9.6.3-r0go

AND

schollz crocMatch10.0.1-r0go

AND

schollz crocMatch9.3.0-r0go

AND

schollz crocMatch9.6.15-r0go

AND

schollz crocMatch9.5.2-r1go

AND

schollz crocMatch8.6.11-r0go

AND

schollz crocMatch9.1.2-r0go

AND

schollz crocMatch9.5.6-r0go

AND

schollz crocMatch9.6.4-r0go

AND

schollz crocMatch9.1.0-r0go

AND

schollz crocMatch9.5.5-r1go

AND

schollz crocMatch9.6.0-r0go

AND

schollz crocMatch9.6.14-r0go

AND

schollz crocMatch9.6.1-r1go

AND

schollz crocMatch9.6.15-r1go

AND

schollz crocMatch9.6.4-r2go

AND

schollz crocMatch9.6.1-r3go

AND

schollz crocMatch9.6.10-r0go

AND

schollz crocMatch9.1.1-r0go

AND

schollz crocMatch9.6.6-r0go

AND

schollz crocMatch9.5.4-r0go

AND

schollz crocMatch9.2.0-r0go

AND

schollz crocMatch9.6.0-r1go

AND

schollz crocMatch9.5.5-r0go

AND

schollz crocMatch9.6.1-r0go

AND

schollz crocMatch9.6.5-r1go

AND

schollz crocMatch9.5.0-r0go

AND

schollz crocMatch9.6.14-r1go

AND

schollz crocMatch9.6.5-r3go

AND

schollz crocMatch9.6.4-r4go

AND

schollz crocMatch8.0.11-r0go

AND

schollz crocMatch9.6.5-r2go

AND

schollz crocMatch9.6.4-r3go

AND

schollz crocMatch8.6.12-r0go

AND

schollz crocMatch9.6.15-r3go

AND

schollz crocMatch8.6.8-r0go

AND

schollz crocMatch9.6.0-r2go

AND

schollz crocMatch9.6.9-r0go

AND

schollz crocMatch9.6.0-r4go

AND

alpinelinux alpine_linuxMatchedge

OR

schollz github.com/schollz/crocRangev0.1.0–0.1.0go

Source	Link
github	www.github.com/schollz/croc/issues/594
bugzilla	www.bugzilla.suse.com/show_bug.cgi
github	www.github.com/advisories/GHSA-8c8w-f7wp-2jr2
openwall	www.openwall.com/lists/oss-security/2023/09/08/2
openwall	www.openwall.com/lists/oss-security/2023/09/21/5

01 Feb 2024 12:06Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.15.5

EPSS0.00066

vulnerability croc protocol arbitrary file overwrite file transfer validation attacker zip archive software