CVE-2023-34460: Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. $HOME/), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the fs endpoint are affected. The regression has been patched on version 1.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Taurito a version that resolves this vulnerability.Fixed in 1.4.1 - Configuration
Only Tauri applications using wildcard scopes in the `fs` endpoint are affected by the dotfiles scope regression; update to the patched version (1.4.1) to restore correct filesystem scope checks for dotfiles on Unix when using wildcard scopes like `$HOME/*`.
Tauri fs endpoint filesystem scope glob wildcard behavior for dotfiles = ensure dotfiles are not implicitly allowed (no regression)
Event History
Frequently Asked Questions
What is CVE-2023-34460?
CVE-2023-34460 refers to a vulnerability in Tauri framework version 1.4.0 that allows dotfiles to be implicitly allowed by the glob wildcard scopes on Unix.
How severe is CVE-2023-34460?
CVE-2023-34460 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2023-34460?
Only Tauri framework version 1.4.0 is affected by CVE-2023-34460.
How can I fix CVE-2023-34460?
The fix for CVE-2023-34460 can be found in the Tauri 1.5.0 release or later.
What is the Common Weakness Enumeration (CWE) ID of CVE-2023-34460?
The Common Weakness Enumeration (CWE) ID of CVE-2023-34460 is CWE-285.