Executive brief
Croc requires senders to provide local IP addresses in cleartext in github.com/schollz/croc
Affected products
- Go github.com/schollz/croc/v8
- Go github.com/schollz/croc/v9
- Go github.com/schollz/croc
- Go github.com/schollz/croc/v6
Junglewise Threat Intelligence
CVE-2023-43618: GO-2023-2070 - Croc requires senders to provide local IP addresses in cleartext in github.com/schollz/croc
CVE-2023-43618 · Severity: low · CVSS 3.1 · Published 2024-08-21
Technologies: github.com/schollz/croc/v8 (Go), github.com/schollz/croc/v9 (Go), github.com/schollz/croc (Go), github.com/schollz/croc/v6 (Go). Vendors: Go.
Related threats
- GO-2023-2073 - Croc sender may send dangerous new files to receiver in github.com/schollz/croc
- GO-2023-2069 - Croc may expose secret to local users in github.com/schollz/croc
- GO-2023-2072 - Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc
- GO-2023-2071 - Sender can cause a receiver to overwrite files during ZIP extraction in Croc in github.com/schollz/croc
- GO-2023-2068 - Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device in github.com/schollz/croc