Vulnerability · Published Mar 11, 2023 · Assigned by VulDB

CVE-2023-1350liferea Feed Enrichment update.c update_job_run os command injection

Medium 6.3

In plain English

A medium-severity OS command injection in liferea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)2.3%top 16.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	liferea	1.14.1-1	DEBIAN-CVE-2023-1350
Debian:13	liferea	1.14.1-1	DEBIAN-CVE-2023-1350
Debian:14	liferea	1.14.1-1	DEBIAN-CVE-2023-1350
Ubuntu:22.04:LTS	liferea	no fix listed	UBUNTU-CVE-2023-1350

Affected products (as reported)

Vendor	Product	Versions
n/a	liferea	1.12.01.12.11.12.21.12.31.12.41.12.51.12.61.12.7

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.222848 vdb-entry, technical-description
https://vuldb.com/?ctiid.222848 signature, permissions-required
https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59 patch