Microsoft Security Advisory CVE-2023-36013: Information Disclosure Vulnerability in PowerShell Web Cmdlets
Nessuno ha ancora preso questa issue.
Valutazione
- Difficoltà
- 5/5
- Tempo stimato
- Più di una settimana
- Idoneità per principianti
- 5/100
Direzione di ricerca
This is a published Microsoft security advisory for CVE-2023-36013 in the PowerShell Web cmdlets, not a code task, and the payload names no file, test or entry point to change. It has no comments, assignees or linked pull requests, and it was created about 1063 days ago. Questions about the PowerShell aspects belong in the support discussion the advisory links to, not in a code change.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Descrizione
Microsoft Security Advisory CVE-2023-36013: Information Disclosure Vulnerability in PowerShell Web Cmdlets
Executive Summary
There is a possibility that in an error case that PowerShell Web cmdlets could disclose authentication information in the error output. PowerShell 7.2, 7.3 and 7.4 RC.1 are affected.
System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).
Discussion
Please open a support question to discuss the PowerShell aspects of this advisory.
Affected Software
The vulnerability affects PowerShell 7 prior to the following versions:
| PowerShell 7 Version | Fixed in |
|---|---|
| 7.2 | 7.2.17 |
| 7.3 | 7.3.10 |
| 7.4 | 7.4.0 |
The vulnerability affects PowerShell when running on the following operating systems:
| Operating System | Affected |
|---|---|
| Windows | Yes |
| macOS | Yes |
| Linux | Yes |
Advisory FAQ
How do I know if I am affected?
If all of the following are true:
- Run
pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.
How do I update to an unaffected version?
Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.
Updating PowerShell 7 using Microsoft Update
Updating PowerShell 7 using Microsoft Update
Other Information
Reporting Security Issues
If you have found a potential security issue in PowerShell 7,
please email details to [email protected].
Support
You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.
Disclaimer
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
What if the update breaks my script or module?
You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.
Acknowledgments
Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.
See acknowledgments for more information.
External Links
Revisions
V1.0 (Nov 16, 2023): Advisory published.
Version 1.0
Last Updated 2023-11-16
- Lingua principale
- Nessun dato sulla lingua
- Stelle
- 20
- Fork
- 8
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Preparare l'ambiente
- Nessun Dockerfile né file Docker Compose
- Nessun modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di PowerShell/Announcements
-
PowerShell Security
Difficoltà 5/5 Più di una settimana Idoneità per principianti 5/100
PowerShell/Announcements#101 ·
-
PowerShell Security
Difficoltà 5/5 Più di una settimana Idoneità per principianti 5/100
PowerShell/Announcements#100 ·
-
PowerShell Security
Difficoltà 2/5 Meno di un'ora Idoneità per principianti 8/100
PowerShell/Announcements#99 ·
-
PowerShell Security
Difficoltà 3/5 Mezza giornata Idoneità per principianti 8/100
PowerShell/Announcements#98 ·
-
PowerShell Security
Difficoltà 2/5 Meno di un'ora Idoneità per principianti 8/100
PowerShell/Announcements#97 ·
Tutte le issue di PowerShell/Announcements
Issue simili
-
enhancement good first issue help wanted
Difficoltà 2/5 1-3 ore Idoneità per principianti 88/100
argus-code-scanning/argus-codescan-mcp#113 ·
I maintainer di solito rispondono entro 1 giorno
-
android copy design-review iphone mac P3
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100
tosunlab/hisarapp-core#480 ·
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 68/100
kiwigrid/k8s-sidecar#669 ·
I maintainer di solito rispondono entro 1 giorno
-
blocklist removal
Difficoltà 2/5 1-3 ore Idoneità per principianti 63/100
MetaMask/eth-phishing-detect#306064 ·
I maintainer di solito rispondono entro 1 giorno
-
bug P1
Difficoltà 2/5 1-3 ore Idoneità per principianti 76/100
Toloka/tolokaforge#1947 ·
I maintainer di solito rispondono entro 1 giorno