It was discovered that when a Dino client receives a specifically crafted message from an unauthorized sender, it would use information from that message to add, update or remove entries in the user’s personal bookmark store without requiring further user interaction. This vulnerability allows the attacker to change how group chats are displayed or to force a user to join or leave an attacker-selected groupchat. This can be used to trick the user to reveal sensitive information to the attacker. https://dino.im/security/cve-2023-28686/ Reproducible: Always
I will send a pull request to update to 0.4.2 and will check to update 0.3.1 to 0.3.2 or remove it completely. Seems I can't assign the bug to myself though.
(The summary rules are a bit silly - it's because we do the "first fixed versions in tree" in there. Do wonder about changing it but it is what it is for now.)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3bdb0c07287e6e7a8dfc2f84297be4452212fe03 commit 3bdb0c07287e6e7a8dfc2f84297be4452212fe03 Author: Michael Vetter <jubalh@iodoru.org> AuthorDate: 2023-03-24 08:24:20 +0000 Commit: Florian Schmaus <flow@gentoo.org> CommitDate: 2023-03-24 08:44:13 +0000 net-im/dino: bump 0.4.1 → 0.4.2 and 0.3.0-r1 → 0.3.2 Addresses CVE-2023-28686. Bug: https://bugs.gentoo.org/902877 Closes: https://github.com/gentoo/gentoo/pull/30328 Signed-off-by: Michael Vetter <jubalh@iodoru.org> Signed-off-by: Florian Schmaus <flow@gentoo.org> net-im/dino/Manifest | 4 ++-- net-im/dino/{dino-0.3.0-r1.ebuild => dino-0.3.2.ebuild} | 0 net-im/dino/{dino-0.4.1-r1.ebuild => dino-0.4.2.ebuild} | 0 3 files changed, 2 insertions(+), 2 deletions(-)
