[GHSA-xjw2-6jm9-rf67] Sandbox escape via various forms of "format".

[m3t3kh4n]

Updates

• Affected products
• CVSS
• CWEs
• Severity

Comments

• CWE was incorrect and it was changed.
• Initial CVSS assessment was conducted.

[github]

Hi there @icemac! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our highly-trained Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[icemac]

I am fine with these changes.

[shelbyc]

Hi @m3t3kh4n and @icemac, I'm interested in learning more about how you reached the conclusions about the appropriate CVSS and CVE for this advisory.

For the CVSS: Sandbox escape usually has some impact on data integrity and availability, but I see that the description only mentions critical information disclosure. Is there a possibility for data integrity and availability impact?

How did each of you choose the CWE you felt was most appropriate?

[icemac]

The values I chose were best guesses as I did this for the first time, so I probably chose unnecessary high values.

[shelbyc]

@icemac Scoring a vulnerability and finding an appropriate CVE can be an uncertain process even for people who work with CVE data every day, and I want to make sure we respect your perspective as the maintainer. 🙂 The most important thing is getting an accurate understanding of the vulnerability. If it's possible for someone to use the vulnerability to mess with data integrity or crash the software or system, we can reflect that in the CVSS. If the only impact is disclosing data when the data shouldn't be disclosed, we can reflect that in the CVSS too.

I'm also happy to answer questions!

[taladrane]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.