OpenRefine vulnerable to zip slip in project import

高 7.8CVE-2023-37476 · GHSA-m88m-crr9-jvqq · 17/07/2023 公開 · 17/06/2026 更新

要点

CVE-2023-37476 は org.openrefine:main, openrefine (openrefine) に影響する深刻度「高」 (CVSS 7.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.63%（全脆弱性の 50.0% より高い）。
対処：3.7.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.openrefine:main Maven	`< 3.7.4`	`3.7.4`
openrefine openrefine	`≤ 3.7.3`	修正版なし

概要

Impact

A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it.

Patches

The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible.

Workarounds

Only import OpenRefine projects from trusted sources.

References

A similar issue existed in the Create Project feature (CVE-2018-19859), which was fixed by PR #1901.

NVD の説明

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.