schollz/croc · Security
Croc may expose secret to local users
- GHSA ID
- GHSA-7g3v-4ggr-xvjf
- CVE ID
- CVE-2023-43621
- Severity
- medium
- Published
- Updated
- CVSS
- 4.7 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 4.7 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
An issue was discovered in Croc before 9.6.16. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-43621 ↗
- https://github.com/schollz/croc/issues/598 ↗
- https://www.openwall.com/lists/oss-security/2023/09/08/2 ↗
- http://www.openwall.com/lists/oss-security/2023/09/21/5 ↗
- https://github.com/schollz/croc/pull/701 ↗
- https://github.com/schollz/croc/commit/863dabb93a271f41b3431c4384357e1856a69533 ↗
- https://github.com/advisories/GHSA-7g3v-4ggr-xvjf ↗