Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/ewen-lbh/ffcss

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3GoPublished

    ewen-lbh/ffcss Late-Unicode normalization vulnerability

    CVE-2023-52081 · GHSA-wpmx-564x-h2mh

    Affected
    • Go github.com/ewen-lbh/ffcss < 0.2.0
    Fixed in
    0.2.0· Vendor fix available
    Issue
    The function lookupPreprocess() is meant to apply some transformations to a string by disabling characters in the regex [- .]. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex [- .]. Take the following equivalent Unicode character U+2024 (․). Initially, the lookupPreprocess() function would compile the regex and replace the regular dot (.). However, the U+2024 (․) would bypass the ReplaceAllString(). When the normalization operation is applied to U+2024 (․), the resulting character will be U+002E (.). Thus, the dot was reintroduced back. Impact The lookupPreprocess() can be easily bypassed with equivalent Unicode characters like U+FE4D (﹍), which would result in the omitted U+005F (), for instance. It should be noted here that the variable s is user-controlled data coming from /cmd/ffcss/commands.go#L22-L28 the command args. The lookupPreprocess() function is only ever…

    Recommended action: Upgrade to 0.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →