Insufficient Input Validation in iTerm2 Affects SSH Hostnames
CVE-2023-46322

9.8CRITICAL

Key Information:

Vendor

Iterm2

Status
Iterm2
Vendor
CVE Published:
23 October 2023

What is CVE-2023-46322?

iTerm2 versions prior to 3.5.0beta12 exhibit a significant input validation flaw in the iTermSessionLauncher.m component. This vulnerability allows for the introduction of SSH hostnames that do not conform to expected alphanumeric formats. Specifically, the initial character of the hostname can be non-alphanumeric, and subsequent characters can include symbols beyond the accepted alphanumeric character set, dash, and period. This lack of proper sanitization poses risks for potential security breaches and operational disruptions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://iterm2.com/downloads.html
https://gitlab.com/gnachman/iterm2/-/commit/ef7bb84520013...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.