~ / search / GHSA-5v4m-c73v-c7gq

GHSA-5v4m-c73v-c7gq

Arbitrary Code Execution in Cookie Serialization

Source: GitHub Advisory Database (reviewed) High CVE-2017-1000053

Packages

EcosystemPackageAffectedFixed in
Hex plug < 1.0.4 1.0.4
Hex plug >= 1.1.0, < 1.1.7 1.1.7
Hex plug >= 1.2.0, < 1.2.3 1.2.3
Hex plug >= 1.3.0, < 1.3.2 1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

The default serialization used by Plug session may result in code execution in certain situations. Keep in mind, however, the session cookie is signed and this attack can only be exploited if the attacker has access to your secret key as well as your signing/encryption salts. We recommend users to change their secret key base and salts if they suspect they have been leaked, regardless of this vulnerability.

References

External links from the advisory. They lead to third-party sites.