When URL parsers disagree (CVE-2023-38633, librsvg)

www.canva.dev

cross-posted to:
reverseengineering@zerobytes.monster
rust@programming.dev
hackernews@lemmit.online
rust@lemmit.online
hackernews@lemmy.smeargle.fans
technews@radiation.party
netsec@lemmy.world

When URL parsers disagree (CVE-2023-38633, librsvg)

www.canva.dev

haxor@derp.fooMB to

Hacker News@derp.fooEnglish · 1 year ago

cross-posted to:
reverseengineering@zerobytes.monster
rust@programming.dev
hackernews@lemmit.online
rust@lemmit.online
hackernews@lemmy.smeargle.fans
technews@radiation.party
netsec@lemmy.world

When URL parsers disagree (CVE-2023-38633) - Canva Engineering Blog

www.canva.dev

Discovery and walkthrough of CVE-2023-38633 in librsvg, when two URL parser implementations (Rust and Glib) disagree on file scheme parsing leading to path traversal.

There is a discussion on Hacker News, but feel free to comment here as well.

You must log in or register to comment.

Chat