CVE-2023-43616

Description

Sender can cause a receiver to overwrite files during ZIP extraction in Croc in github.com/schollz/croc

How to fix CVE-2023-43616

To remediate CVE-2023-43616, upgrade the affected package to a fixed version below.

• Go/github.com/schollz/croc—upgrade to 9.6.16 or later
• —no fix listed
• —no fix listed
• —no fix listed
• —upgrade to 9.6.16 or later

Is CVE-2023-43616 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 9.6.16
• from 0
• from 0
• from 0
• from 0, < 9.6.16

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-8c8w-f7wp-2jr2
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-43616
• PATCHgithub.com/schollz/croc
• WEBgithub.com/schollz/croc/commit/4929635eb875d2304e9415b8f4aa62af9e1a2339
• WEB