CVE-2023-34112: JavaCPP project actions vulnerable to code injection
JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the bytedeco/javacpp-presets use the github.event.headcommit.message? parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.
Other sources
JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the bytedeco/javacpp-presets use the github.event.headcommit.message parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bytedeco/javacpp-presetsto a version that resolves this vulnerability.Fixed in 1.5.9
Event History
Frequently Asked Questions
What is CVE-2023-34112?
CVE-2023-34112 is a vulnerability in JavaCPP Presets that allows for command injection.
How does the vulnerability in JavaCPP Presets occur?
The vulnerability occurs because the `github.event.head_commit.message` parameter is used in an insecure way, allowing for command injection.
What is the severity of CVE-2023-34112?
The severity of CVE-2023-34112 is high, with a CVSS score of 8.8.
What is the affected software?
The affected software is Bytedeco Javacpp Presets up to version 1.5.9.
How can I fix CVE-2023-34112?
To fix CVE-2023-34112, you should update to a version of Bytedeco Javacpp Presets that is higher than 1.5.9.