CYBER CODE RED

Get real-time updates on Telegram

ghsa:GHSA-H4FR-CMH5-QR62: fallow < 3.34.0; +4 more affected products

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root. Affected range: < 3.34.0. Fixed version: 3.34.0. Affected range: < 3.34.0. Fixed version: 3.34.0. Affected range: < 3.34.0. Fixed version: 3.34.0. Affected range: < 3.34.0. Fixed version: 3.34.0. Affected range: < 3.34.0. Fixed version: 3.34.0.

Affected technology

fallow · < 3.34.0
Vendor not specified by the source

@fallow-cli/fallow-node · < 3.34.0
Vendor not specified by the source

fallow-cli · < 3.34.0
Vendor not specified by the source

fallow-config · < 3.34.0
Vendor not specified by the source

fallow-core · < 3.34.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

Then the attacker can learn if a file or directory exists in the parent of the project root: - A plugin `fileExists` detection pattern such as `.*/marker.json` made the plugin active when `marker.json` existed in the parent directory. - An external plugin `configPatterns` or `alwaysUsed` pattern could match a config file in the parent directory. Source advisory’s CVSS 3.1 assessment rates confidentiality impact as low; integrity and availability impact as none.

Published

Product
fallow
KEV
no

Provenance

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-h4fr-cmh5-qr62.html