Описание
A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.
Ссылки
- PatchThird Party Advisory
- ExploitThird Party Advisory
- PatchThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:buildroot:buildroot:2023.08.1:*:*:*:*:*:*:*
EPSS
Процентиль: 32%
0.00122
Низкий
8.1 High
CVSS3
Дефекты
CWE-494
CWE-494
Связанные уязвимости
CVSS3: 8.1
github
около 2 лет назад
A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.
EPSS
Процентиль: 32%
0.00122
Низкий
8.1 High
CVSS3
Дефекты
CWE-494
CWE-494