Publish GHSA-3hpf-ff72-j67p

2026-05-22 18:04:22 -07:00 · 2024-12-06 21:26:25 +00:00
parent 0bdf7dad05
commit 74f2d97f61
1 changed files with 62 additions and 0 deletions
@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3hpf-ff72-j67p",
+  "modified": "2024-12-06T21:24:30Z",
+  "published": "2024-12-06T21:24:30Z",
+  "aliases": [],
+  "summary": "shared_preferences_android vulnerability",
+  "details": "### Impact\nDue to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution.\n\nAs a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk.\n\n### Patches\n2.3.4\n\n### Workarounds\nUpdate to the latest version of shared_preferences_android that contains the changes to address this vulnerability.\n\n### References\nTBD\n\n### For more information\nSee [our community page](https://dart.dev/community) to find ways to contact the team.\n\n### Thanks\nThank you so much to Oskar Zeino-Mahmalat from sonarsource for finding and reporting this issue!",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Pub",
+        "name": "shared_preferences_android"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.3.3"
+            },
+            {
+              "fixed": "2.3.4"
+            }
+          ]
+        }
+      ],
+      "versions": [
+        "2.3.3"
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/flutter/packages/security/advisories/GHSA-3hpf-ff72-j67p"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/flutter/packages/commit/15501ece235684a3bdddad089345fc3e33dc1df3"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/flutter/packages"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-06T21:24:30Z",
+    "nvd_published_at": null
+  }
+}