GHSA-pwjq-6wrh-5w8q
Withdrawn Advisory: OnionShare Predictable Pathname
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | onionshare-cli | <= 1.3.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
## Withdrawn Advisory
This advisory has been withdrawn because the advisory concerns the repository https://github.com/onionshare/onionshare, which is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). [onionshare-cli](https://pypi.org/project/onionshare-cli/) is not affected by this issue.
## Original Description
The `debug_mode` function in `web/web.py` in OnionShare through 1.3.1, when `--debug` is enabled, uses the `/tmp/onionshare_server.log` pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2018-19960
- https://github.com/onionshare/onionshare/issues/837
- https://github.com/onionshare/onionshare/commit/4da5e15581a69509e7bfc6c4d0742052e0b61b24
- https://github.com/onionshare/onionshare/commit/aa5fdde6a4e4de7f113e01a3b446dcc14dcecb1a
- https://bugs.debian.org/915859
- https://github.com/onionshare/onionshare