GHSA-6rvj-pw9w-jcvc

Information disclosure vulnerability in OnionShare

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-41867

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	onionshare-cli	>= 2.3, < 2.4	2.4

Details

As written in the advisory (Markdown source, shown as plain text).

An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-41867 advisory
https://github.com/onionshare/onionshare package
https://github.com/onionshare/onionshare/compare/v2.3.3...v2.4 web
https://www.ihteam.net/advisory/onionshare web