opensuse-su-2024:13635-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
python3-onionshare-2.6-4.1 on GA media

Notes

Title of the patch
python3-onionshare-2.6-4.1 on GA media
Description of the patch
These are all security issues fixed in the python3-onionshare-2.6-4.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-13635
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python3-onionshare-2.6-4.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python3-onionshare-2.6-4.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-13635",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13635-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19960 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19960/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-41867 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-41867/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-41868 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-41868/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-21688 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-21688/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-21690 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-21690/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-21691 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-21691/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-21692 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-21692/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-21693 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-21693/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-21694 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-21694/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-21695 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-21695/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-21696 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-21696/"
      }
    ],
    "title": "python3-onionshare-2.6-4.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:13635-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-onionshare-2.6-4.1.aarch64",
                "product": {
                  "name": "python3-onionshare-2.6-4.1.aarch64",
                  "product_id": "python3-onionshare-2.6-4.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-onionshare-2.6-4.1.ppc64le",
                "product": {
                  "name": "python3-onionshare-2.6-4.1.ppc64le",
                  "product_id": "python3-onionshare-2.6-4.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-onionshare-2.6-4.1.s390x",
                "product": {
                  "name": "python3-onionshare-2.6-4.1.s390x",
                  "product_id": "python3-onionshare-2.6-4.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-onionshare-2.6-4.1.x86_64",
                "product": {
                  "name": "python3-onionshare-2.6-4.1.x86_64",
                  "product_id": "python3-onionshare-2.6-4.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-onionshare-2.6-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64"
        },
        "product_reference": "python3-onionshare-2.6-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-onionshare-2.6-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le"
        },
        "product_reference": "python3-onionshare-2.6-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-onionshare-2.6-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x"
        },
        "product_reference": "python3-onionshare-2.6-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-onionshare-2.6-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        },
        "product_reference": "python3-onionshare-2.6-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-19960",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19960"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19960",
          "url": "https://www.suse.com/security/cve/CVE-2018-19960"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1120205 for CVE-2018-19960",
          "url": "https://bugzilla.suse.com/1120205"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-19960"
    },
    {
      "cve": "CVE-2021-41867",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-41867"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-41867",
          "url": "https://www.suse.com/security/cve/CVE-2021-41867"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191311 for CVE-2021-41867",
          "url": "https://bugzilla.suse.com/1191311"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-41867"
    },
    {
      "cve": "CVE-2021-41868",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-41868"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-41868",
          "url": "https://www.suse.com/security/cve/CVE-2021-41868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191312 for CVE-2021-41868",
          "url": "https://bugzilla.suse.com/1191312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-41868"
    },
    {
      "cve": "CVE-2022-21688",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-21688"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affected versions of the desktop application were found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is required. An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack, which quickly results in out-of-memory for the server. This requires the desktop application with rendered history, therefore the impact is only elevated. This issue has been patched in version 2.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-21688",
          "url": "https://www.suse.com/security/cve/CVE-2022-21688"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194866 for CVE-2022-21688",
          "url": "https://bugzilla.suse.com/1194866"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-21688"
    },
    {
      "cve": "CVE-2022-21690",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-21690"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components for displaying the server access history. This leads to a rendered HTML4 Subset (QT RichText editor) in the Onionshare frontend.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-21690",
          "url": "https://www.suse.com/security/cve/CVE-2022-21690"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194866 for CVE-2022-21690",
          "url": "https://bugzilla.suse.com/1194866"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-21690"
    },
    {
      "cve": "CVE-2022-21691",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-21691"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-21691",
          "url": "https://www.suse.com/security/cve/CVE-2022-21691"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194866 for CVE-2022-21691",
          "url": "https://bugzilla.suse.com/1194866"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-21691"
    },
    {
      "cve": "CVE-2022-21692",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-21692"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions anyone with access to the chat environment can write messages disguised as another chat participant.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-21692",
          "url": "https://www.suse.com/security/cve/CVE-2022-21692"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194866 for CVE-2022-21692",
          "url": "https://bugzilla.suse.com/1194866"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-21692"
    },
    {
      "cve": "CVE-2022-21693",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-21693"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions an adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced. This can be mitigated by usage of the flatpak release.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-21693",
          "url": "https://www.suse.com/security/cve/CVE-2022-21693"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194866 for CVE-2022-21693",
          "url": "https://bugzilla.suse.com/1194866"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-21693"
    },
    {
      "cve": "CVE-2022-21694",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-21694"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-21694",
          "url": "https://www.suse.com/security/cve/CVE-2022-21694"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194866 for CVE-2022-21694",
          "url": "https://bugzilla.suse.com/1194866"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-21694"
    },
    {
      "cve": "CVE-2022-21695",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-21695"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-21695",
          "url": "https://www.suse.com/security/cve/CVE-2022-21695"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194866 for CVE-2022-21695",
          "url": "https://bugzilla.suse.com/1194866"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-21695"
    },
    {
      "cve": "CVE-2022-21696",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-21696"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
          "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-21696",
          "url": "https://www.suse.com/security/cve/CVE-2022-21696"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194866 for CVE-2022-21696",
          "url": "https://bugzilla.suse.com/1194866"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.aarch64",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.ppc64le",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.s390x",
            "openSUSE Tumbleweed:python3-onionshare-2.6-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-21696"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.