CVE-2020-11722
Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote ...
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Ubuntu (orta).
Açıklama
Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 10 | crawl | düzeltme belirtilmemiş |
| debian 11 | crawl | 2:0.25.0-1 |
| debian 12 | crawl | 2:0.25.0-1 |
| debian 13 | crawl | 2:0.25.0-1 |
| debian 14 | crawl | 2:0.25.0-1 |
| debian 8 | crawl | düzeltme belirtilmemiş |
| debian 9 | crawl | düzeltme belirtilmemiş |
| echo | crawl | 2:0.25.0-1 |
| ubuntu 16.04-ESM | crawl | 2:0.17.1-1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | crawl | 2:0.21.1-1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | crawl | 2:0.24.0-1ubuntu0.1~esm1 |
Referanslar
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00037.html
- https://dpmendenhall.blogspot.com/2020/03/dungeon-crawl-stone-soup.html
- https://github.com/crawl/crawl/commit/768f60da87a3fa0b5561da5ade9309577c176d04
- https://github.com/crawl/crawl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QLPN635S7J3MUXLIHYK6MDAHEIASFYP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNXK7QE7EA7XSDDNOWX2A6MJNWOIYCTC/
- https://ubuntu.com/security/notices/USN-7969-1
- https://www.cve.org/CVERecord?id=CVE-2020-11722