Insufficient restrictions in validate functions of CSAF full validators
view advisory published 2022-09-01
The CSAF full validator implementations csaf-validator-lib and csaf-validator-service provided by the Secvisogram project are missing the validation of the provided test names. Updates are available.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-47925US | — | — | ||
The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insufficient input validation of requests by an… | ||||
| CVE-2022-47924US | medium6.5 | — | ||
An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wich can result in arbi… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- Fixedcsaf-validator-lib
Update to version 0.1.0 or later.
- Fixedcsaf-validator-service
Update to version 1.0.1 or later. This also resolves the potential version confusion.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan