GHSA-R4JG-5V89-9V62高危已审查已撤回

Withdrawn: Octocat.js vulnerable to code injection

OSV 1.4.0 · github-reviewed · 修改于 2022-11-10 06:35

发布时间

2022-11-09 04:48

GitHub 审查时间

2022-11-09 04:48

NVD 发布时间

2022-11-09 09:15

源文件

advisories/github-reviewed/2022/11/GHSA-r4jg-5v89-9v62/GHSA-r4jg-5v89-9v62.json

该公告已于 2022-11-10 06:35 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Withdrawn

This advisory has been withdrawn because it is a test.

Original Description

Impact

Users can include their own images for accessories via provided URLs. These URLs are not validated and can result in execution of injected code.

Patches

This vulnerability was fixed in version 1.2 of octocat.js

Workarounds

Directly exposing rendered images to a website can introduce the vulnerability to users. To avoid, writing an image to disk then using that image in an image element in HTML mitigates the risk.

References

To render the file correctly, see documentation at readme.md

For more information

If you have any questions or comments about this advisory:

Open an issue in the octo.js repository

受影响的软件包

npm

octocat.js

标识信息

别名 / CVE

CVE-2022-39390

CWE

CWE-74CWE-94

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-r4jg-5v89-9v62",
  "aliases": [
    "CVE-2022-39390"
  ],
  "details": "## Withdrawn\n\nThis advisory has been withdrawn because it is a test.\n\n## Original Description\n\n### Impact\nUsers can include their own images for accessories via provided URLs. These URLs are not validated and can result in execution of injected code.\n\n### Patches\nThis vulnerability was fixed in version 1.2 of octocat.js\n\n### Workarounds\nDirectly exposing rendered images to a website can introduce the vulnerability to users. To avoid, writing an image to disk then using that image in an image element in HTML mitigates the risk.\n\n### References\nTo render the file correctly, see documentation at `readme.md`\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the octo.js repository](http://github.com/octocademy/octocat.js/issues)\n",
  "summary": "Withdrawn: Octocat.js vulnerable to code injection",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2"
            }
          ]
        }
      ],
      "package": {
        "name": "octocat.js",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2022-11-09T22:35:46Z",
  "severity": [],
  "published": "2022-11-08T20:48:49Z",
  "withdrawn": "2022-11-09T22:35:46Z",
  "references": [
    {
      "url": "https://github.com/octocademy/octocat.js/security/advisories/GHSA-r4jg-5v89-9v62",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39390",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/octocademy/octocat.js",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-94"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2022-11-09T01:15:00Z",
    "github_reviewed_at": "2022-11-08T20:48:49Z"
  }
}