GHSA-7g3v-4ggr-xvjf

Croc may expose secret to local users

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-43621

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/schollz/croc/v9	< 9.6.16	9.6.16

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Croc before 9.6.16. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-43621 advisory
https://github.com/schollz/croc/issues/598 web
https://github.com/schollz/croc/pull/701 web
https://github.com/schollz/croc/commit/863dabb93a271f41b3431c4384357e1856a69533 web
https://github.com/schollz/croc package
https://www.openwall.com/lists/oss-security/2023/09/08/2 web
http://www.openwall.com/lists/oss-security/2023/09/21/5 web