GitHub Advisoryadvisory · Go

GHSA-jv3f-7m33-qp65 Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

MEDIUM Published 2023-05-26 Modified 2023-06-01 Official page ↗
Aliases
CVE-2023-33955
Ecosystem
Go
Packages
github.com/minio/console
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-05-26

Affected packages

• Go github.com/minio/console: < 0.28.0 → fixed in 0.28.0

Description

Impact Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. Reported-By Thanks to the report from Mio Li [email protected] Patches ``` commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60 Author: Daniel Valdivia Date: Tue May 23 08:47:12 2023 -0700 Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828) Signed-off-by: Daniel Valdivia ``` Workarounds Workarounds are to remove the concerned file and rewrite it properly with the right file and extensions. Avoid using RTLO characters in your filenames.

Related

Alias · CVE (1)

  • CVE-2023-33955 Minio Console is the UI for MinIO Object Storage. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References