Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the stream option is enabled in the configuration. (This option is disabled by default.) Patches 3.0.3 contains a fix for this vulnerability. (The 1.x and 2.x releases are not maintained anymore.) The fix requires applying a patch to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched. However, if you are using your own unpatched version of youtube-dl you might still be vulnerable. References https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a https://github.com/ytdl-org/youtube-dl/issues/30691
Recommended action: Upgrade to 3.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Releases prior to 3.0.2 are vulnerable to a Server-Side Request Forgery vulnerability that allows an attacker to send a request to an internal hostname. Patches 3.0.2 contains a fix for this vulnerability. (The 1.x and 2.x releases are not maintained anymore.) Part of the fix requires applying a patch to youtube-dl to prevent it from following HTTP redirects. If you are using the version of youtube-dl bundled with 3.0.2, it is already patched. However, if you are using your own unpatched version of youtube-dl you might still be vulnerable. References https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d https://github.com/Rudloff/alltube/commit/1b099bb9836a3ce7c427a41722a7ab5a3d1c1b2d https://huntr.dev/bounties/9b14cc46-ec08-4940-83cc-9f986b2a5903/ https://nvd.nist.gov/vuln/detail/CVE-2022-0768 https://github.com/ytdl-org/youtube-dl/issues/30691
Recommended action: Upgrade to 3.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Releases prior to 3.0.1 are vulnerable to an open redirect vulnerability that allows an attacker to construct a URL that redirects to an arbitrary external domain. Patches 3.0.1 contains a fix for this vulnerability. (The 1.x and 2.x releases are not maintained anymore.) References https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203/ https://nvd.nist.gov/vuln/detail/CVE-2022-0692
Recommended action: Upgrade to 3.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.