CVE-2023-43621: Croc may expose secret to local users

September 20, 2023 (updated September 21, 2023)

An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.

References

github.com/advisories/GHSA-7g3v-4ggr-xvjf
github.com/schollz/croc/issues/598
nvd.nist.gov/vuln/detail/CVE-2023-43621
www.openwall.com/lists/oss-security/2023/09/08/2

Code Behaviors & Features

Detect and mitigate CVE-2023-43621 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →