Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 902877 (CVE-2023-28686)

Summary: <net-im/dino-{0.3.2,0.4.2}: Insufficient message sender validation
Product: Gentoo Security Reporter: Michael Vetter <jubalh>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: IN_PROGRESS ---    
Severity: minor CC: flow, maintainer-needed, sam
Priority: Normal Keywords: PullRequest
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://dino.im/security/cve-2023-28686/
See Also: https://github.com/gentoo/gentoo/pull/30328
Whiteboard: B3 [glsa?]
Package list:
Runtime testing required: ---

Description Michael Vetter 2023-03-24 07:58:57 UTC 
It was discovered that when a Dino client receives a specifically crafted message from an unauthorized sender, it would use information from that message to add, update or remove entries in the user’s personal bookmark store without requiring further user interaction.

This vulnerability allows the attacker to change how group chats are displayed or to force a user to join or leave an attacker-selected groupchat. This can be used to trick the user to reveal sensitive information to the attacker.

https://dino.im/security/cve-2023-28686/

Reproducible: Always
Comment 1 Michael Vetter 2023-03-24 08:01:02 UTC 
I will send a pull request to update to 0.4.2 and will check to update 0.3.1 to 0.3.2 or remove it completely.

Seems I can't assign the bug to myself though.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-03-24 08:02:31 UTC 
(The summary rules are a bit silly - it's because we do the "first fixed versions in tree" in there. Do wonder about changing it but it is what it is for now.)
Comment 3 Larry the Git Cow gentoo-dev 2023-03-24 08:44:33 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3bdb0c07287e6e7a8dfc2f84297be4452212fe03

commit 3bdb0c07287e6e7a8dfc2f84297be4452212fe03
Author:     Michael Vetter <jubalh@iodoru.org>
AuthorDate: 2023-03-24 08:24:20 +0000
Commit:     Florian Schmaus <flow@gentoo.org>
CommitDate: 2023-03-24 08:44:13 +0000

    net-im/dino: bump 0.4.1 → 0.4.2 and 0.3.0-r1 → 0.3.2
    
    Addresses CVE-2023-28686.
    
    Bug: https://bugs.gentoo.org/902877
    Closes: https://github.com/gentoo/gentoo/pull/30328
    Signed-off-by: Michael Vetter <jubalh@iodoru.org>
    Signed-off-by: Florian Schmaus <flow@gentoo.org>

 net-im/dino/Manifest                                    | 4 ++--
 net-im/dino/{dino-0.3.0-r1.ebuild => dino-0.3.2.ebuild} | 0
 net-im/dino/{dino-0.4.1-r1.ebuild => dino-0.4.2.ebuild} | 0
 3 files changed, 2 insertions(+), 2 deletions(-)