CVE-2023-37476

OpenRefine vulnerable to zip slip in project import

概要

取得元が公開している説明をそのまま載せています (多くは英語)。

A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it.

The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible.

Only import OpenRefine projects from trusted sources.

A similar issue existed in the Create Project feature (CVE-2018-19859), which was fixed by PR #1901.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Maven org.openrefine:main

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4"}]}]

各ディストリビューションが公開している、この CVE の修正パッケージ

CWE-22