GHSA-ppjh-xp5v-46wc

Croc sender may send dangerous new files to receiver

Source: GitHub Advisory Database (reviewed) High CVE-2023-43619

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/schollz/croc/v9	< 9.6.16	9.6.16

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Croc before 9.6.16. A sender may send dangerous new files to a receiver, such as executable content or a `.ssh/authorized_keys` file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-43619 advisory
https://github.com/schollz/croc/issues/593 web
https://github.com/schollz/croc/pull/697 web
https://github.com/schollz/croc/commit/3f12f75fae2e844c555ec01eeba0b8474938e93a web
https://github.com/schollz/croc package
https://www.openwall.com/lists/oss-security/2023/09/08/2 web
http://www.openwall.com/lists/oss-security/2023/09/21/5 web