Gentoo soko contains DoS attack based on SQL Injection

CVE-2023-26033

What is CVE-2023-26033?

Gentoo Soko, the foundation behind packages.gentoo.org, is vulnerable to SQL Injection in versions prior to 1.0.1, potentially allowing attackers to modify the SQL queries executed in the system. When users select the 'Recently Visited Packages' view, the application uses values from the 'search_history' cookie, which can be manipulated by an attacker to execute arbitrary SQL commands. Although this vulnerability does not compromise the confidentiality of data, it poses a risk of data alteration, leading to Denial of Service. Users are advised to upgrade to version 1.0.1, which includes a fix, or apply workarounds that involve either using a proxy to strip the cookie or sanitizing its value after decoding. For more details, refer to the provided references for security advisories and commit information.

References