Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 6 Jun 2023 10:12:15 -0700
From: Michael Jumper <>
Subject: [SECURITY] CVE-2023-30575: Apache Guacamole: Incorrect calculation of
 Guacamole protocol element lengths

Severity: moderate
Base CVSS Score: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Affected versions:

- Apache Guacamole through 1.5.1


Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths 
of instruction elements sent during the Guacamole protocol handshake, 
potentially allowing an attacker to inject Guacamole instructions during 
the handshake through specially-crafted data.


Users of versions of Apache Guacamole 1.5.1 and older should upgrade to 
the 1.5.2 release.


We would like to thank Stefan Schiller (Sonar) for reporting this issue.



2023-04-11: Reported to
2023-04-11: Report acknowledged by project
2023-04-12: Report confirmed by project
2023-05-09: Fix completed and merged
2023-05-09: Fix tested and confirmed by reporter
2023-05-25: Fix released

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.