Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-43620 · ADVISORY
• schollz/croc · WEB
• schollz/croc#697 · WEB
• schollz/croc commit 3f12f75 · WEB
• schollz/croc · PACKAGE
• openwall.com/lists/oss-security/2023/09/08/2 · WEB
• openwall.com/lists/oss-security/2023/09/21/5 · WEB
• GitHub Advisory GHSA-364c-vvqx-446c · ADVISORY

Weitere Schwachstellen in github.com/schollz/croc

• CVE-2023-43621MITTEL 4.7An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all process…
• CVE-2023-43619HOCH 7.8An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/aut…
• CVE-2023-43618MITTEL 5.3An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? mes…
• CVE-2023-43617MITTEL 5.3An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret…
• CVE-2023-43616MITTEL 5.5An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.