890565 – (CVE-2023-21779) <app-editors/vscode-1.74.3 <app-editors/vscodium-1.74.3.23010: remote code execution vulnerability

Bug 890565 (CVE-2023-21779) - <app-editors/vscode-1.74.3 <app-editors/vscodium-1.74.3.23010: remote code execution vulnerability

Summary: <app-editors/vscode-1.74.3 <app-editors/vscodium-1.74.3.23010: remote code ex...

Status:	RESOLVED FIXED

Alias:	CVE-2023-21779

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	~2 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2023-01-12 02:42 UTC by John Helmert III
Modified:	2023-01-15 16:03 UTC (History)
CC List:	3 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2023-01-12 02:42:10 UTC

CVE-2023-21779 (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21779):

Visual Studio Code Remote Code Execution.

With some digging, we can find some more information despite Microsoft's useless CVE:

https://code.visualstudio.com/updates/v1_74
https://github.com/microsoft/vscode/issues/170992
https://github.com/microsoft/vscode/security/advisories/GHSA-p996-wrgh-crrj

So, the fix is in 1.74.3, and the commit is (not associated with any
tag according to Github..):

https://github.com/microsoft/vscode/commit/5b8361bc717608db4359c2572d5b447f94bc3fb8

So, please bump to 1.74.3.

Comment 1 Arthur Zamarin archtester

2023-01-14 08:17:38 UTC

Bumped both to 1.74.3 and cleaned up all old versions

Comment 2 John Helmert III archtester

2023-01-15 16:03:03 UTC

Thanks, all done!