CVE-2023-45823 — HIGH (7.5)

Q: How severe is CVE-2023-45823?

CVE-2023-45823 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2023-45823?

Check the references section above for vendor advisories and patch information. Affected products include: Artifacthub Hub.

Vulnerability Description

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories loaded into Artifact Hub, it was possible to read internal files. Artifact Hub indexes content from a variety of sources, including git repositories. When processing git based repositories, Artifact Hub clones the repository and, depending on the artifact kind, reads some files from it. During this process, in some cases, no validation was done to check if the file was a symbolic link. This made possible to read arbitrary files in the system, potentially leaking sensitive information. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Artifacthub	Hub	< 1.16.0

Related Weaknesses (CWE)

CWE-22

References

https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&vProduct
https://github.com/artifacthub/hub/security/advisories/GHSA-hmq4-c2r4-5q8hThird Party Advisory
https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&vProduct
https://github.com/artifacthub/hub/security/advisories/GHSA-hmq4-c2r4-5q8hThird Party Advisory

FAQ

What is CVE-2023-45823?

CVE-2023-45823 is a vulnerability with a CVSS score of 7.5 (HIGH). Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security r...

How severe is CVE-2023-45823?

CVE-2023-45823 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-45823?

Check the references section above for vendor advisories and patch information. Affected products include: Artifacthub Hub.