GHSA-j42f-wc6v-5xpq: Duplicate Advisory: Permissive Regular Expression in tacquito
This advisory was withdrawn on Nov 1, 2024. The publisher no longer considers it a valid vulnerability.
Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. That would have potentially allowed unauthorized commands to be executed.
Published Oct 17, 2024 · Updated Nov 1, 2024
Affected packages
github.com/tacquito/tacquito
- Ecosystem
- Go
- Affected
- < 0.0.0-20241011192817-07b49d1358e6
- Fixed in
- 0.0.0-20241011192817-07b49d1358e6
- Check
go list -m github.com/tacquito/tacquito
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. That would have potentially allowed unauthorized commands to be executed.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology