CVE-2023-27372
SPIP before 4.2.1 allows Remote Code Execution via form values in the ...
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Ubuntu (moyenne).
Description
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 10 | spip | 3.2.4-1+deb10u10 |
| debian 11 | spip | 3.2.11-3+deb11u7 |
| debian 13 | spip | 4.1.8+dfsg-1 |
| debian 14 | spip | 4.1.8+dfsg-1 |
| echo | spip | 4.1.8+dfsg-1 |
| rapidfort ubuntu 20.04 | spip | 0:4.1.1+dfsg-1 |
| rapidfort ubuntu 22.04 | spip | 0:4.1.1+dfsg-1 |
| rapidfort ubuntu 24.04 | spip | 0:4.1.1+dfsg-1 |
| ubuntu 18.04-ESM | spip | 3.1.4-4~deb9u5ubuntu0.1~esm2 |
| ubuntu 20.04-ESM | spip | 3.2.7-1ubuntu0.1+esm2 |
| ubuntu 22.04 | spip | pas de correctif indiqué |
Références
- http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html
- https://blog.spip.net/Mise-a-jour-sortie-de-SPIP-4-2-2-SPIP-4-1-9-SPIP-4-0-11-et-SPIP-3-2-19.html%20%28regression%20update%29
- https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266
- https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266%20%28v3.2.18%29
- https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d
- https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d%20%28master%29
Les 14 références
- https://git.spip.net/spip/svp/commit/d463bc549b13bc45651051f83760e8ce274c98d9%20%28SVP%2C%20regression%20fix%29
- https://packetstorm.news/files/id/171921
- https://packetstorm.news/files/id/173044
- https://ubuntu.com/security/notices/USN-7318-1
- https://www.cve.org/CVERecord?id=CVE-2023-27372
- https://www.debian.org/security/2023/dsa-5367