-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ninka license identification tool insufficient escaping of external input CVE-2017-7239 / CVSS 9.3 1.06 The ninka license identification tool does not properly escape special characters in the files it encounters - such as the a&a. In case of an alien code bases; or a code base that is brought in for examination - a third party may doctor the file names as to cause a certain result of the license compliance scan. Or the attacker may adversely affect the ninka user their environment (e.g. an automated continuous integration setup) by causing it to hang. This can then lead to unauthorised disclosure of information, unreliable compliance information or a denial of services. Versions affected: - - ------------------ All versions up to and including version 1.3. Resolution: - - ----------- Upgrade to version 1.3.1 or later - available on https://github.com/dmgerman/ninka. As of commit 75fb67c36a1c4dcec6b9b2c4e7102a1000066c4f the tool give an error when 'illegal characters' are detected. Mitigations and work arounds: - - ----------------------------- Test the filenames passed for obvious issues. Given that ninka is generally only applied to (source)code - a regex matching just the alphanumerics and a few glyphs such as the dash and dot can usually be applied. Credits and timeline - - -------------------- The flaw was found and reported by Dirk-Willem van Gulik fixed the issue on the 27th of March 2017. 2017-01-28 vulnerability found, reported to authors. 2017-03-21 sample found in alien codebase. 2017-03-23 reported to more recent email addresses of authors . 2017-03-26 reported to the authors by phone. 2017-03-27 CVE issued by mitre. fix created by author and pushed to github. 2017-04-01 Full disclosure. Common Vulnerability Scoring (Version 3) and vector - - --------------------------------------------------- CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RC:R/CR:L/IR :L/AR:L/MAV:L/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H CVSS Base Score 9.3 CVSS Temporal Score 9.0 CVSS Environmental Score 6.4 1.06 / : 2717 $ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0 iEYEARECAAYFAljhGecACgkQ/W+IxiHQpxtywwCePUZgUJJ2Z3ly9Bfxk/EOz/aG PQ8AoIF6Bc6cRV8862314Lf3Eod6Om0g =AwPW -----END PGP SIGNATURE-----