SZB-dd210e3bb0
croc versions before 11.5.2 treat sender-chosen filenames as trusted text
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- schollz
- Product
- croc
- First seen
Summary
The EUVD database entry describes a flaw in croc's receive-side file-readiness loop that trusts sender-controlled basenames beginning with croc-stdin-. The entry gives a CVSS v3.1 score of 4.2/10.
If you use schollz
Update croc to version 11.5.2 or later
Avoid receiving transfers from untrusted senders until updated
What the sources say 1
· Mastodon: “Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transf” Source