lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in question doesn't handle the backslash (`\`) character in the username correctly, leading to a wrong output. ex. a payload of `https://example.com\\@google.com` would return that the host is `google.com`, but the correct host should be `example.com`. Given that the library returns the wrong authority this may be abused to bypass host restrictions depending on how the library is used in an application. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-     regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the     wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in question doesn't     handle the backslash (`\`) character in the username correctly, leading to a wrong output. ex. a payload     of `https://example.com\\@google.com` would return that the host is `google.com`, but the correct host     should be `example.com`. Given that the library returns the wrong authority this may be abused to bypass     host restrictions depending on how the library is used in an application. Users are advised to upgrade.
    There are no known workarounds for this vulnerability. (CVE-2023-28628)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-
    regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the
    wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in question doesn't
    handle the backslash (`\`) character in the username correctly, leading to a wrong output. ex. a payload
    of `https://example.com\\@google.com` would return that the host is `google.com`, but the correct host
    should be `example.com`. Given that the library returns the wrong authority this may be abused to bypass
    host restrictions depending on how the library is used in an application. Users are advised to upgrade.
    There are no known workarounds for this vulnerability. (CVE-2023-28628)

ID	Name	Product	Family	Severity
262268	Linux Distros Unpatched Vulnerability : CVE-2023-28628	Nessus	Misc.	medium
413989	SCA: security update for lambdaisland:uri (GHSA-cp4w-6x4w-v2h5)	Tenable Cloud Security	SCA Checks	medium
413989	SCA: security update for lambdaisland:uri (GHSA-cp4w-6x4w-v2h5)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2023-28628

medium

Tenable Plugins

medium

medium

medium