Date: Thu, 23 Mar 2023 12:35:59 -0600 From: Dino Team <team@...o.im> To: oss-security@...ts.openwall.com Subject: [CVE-2023-28686] Insufficient message sender validation in Dino ### Affected software Dino (Instant Messenger) - https://dino.im/ ### Severity Medium (5.3): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N ### Affected versions - Release version 0.4.0 and 0.4.1 - Release version 0.3.0 and 0.3.1 - Release version 0.2.2 and earlier - Nightly version 0.4.1-13-g6690d8e4 and earlier ### Fixed versions - Release version 0.4.2 - Release version 0.3.2 - Release version 0.2.3 - Nightly version 0.4.1-14-gef8fb0e9 ### Description It was discovered that when a Dino client receives a specifically crafted message from an unauthorized sender, it would use information from that message to add, update or remove entries in the user's personal bookmark store without requiring further user interaction. This vulnerability allows the attacker to change how group chats are displayed or to force a user to join or leave an attacker-selected groupchat. This can be used to trick the user to reveal sensitive information to the attacker. ### Advice All deployments should upgrade to a fixed version or apply the patch from commit ef8fb0e94ce79d5fde2943e433ad0422eb7f70ec. ### Credits Many thanks to Kim Alvefur for discovering and reporting this issue. ### Links - https://dino.im/security/cve-2023-28686/ - https://github.com/dino/dino/commit/ef8fb0e - https://github.com/dino/dino/releases/tag/v0.4.2 - https://github.com/dino/dino/releases/tag/v0.3.2 - https://github.com/dino/dino/releases/tag/v0.2.3 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28686
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.