{"metadata": {"vulnerability": "GHSA-hrw9-ggg3-3r4r", "count": 11, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2023-09-28T17:56:32.614Z", "date_only": false, "value": "2023-09-28T17:56:32.614Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2023-44398", "record": "CVE-2023-44398", "field": "cveMetadata.dateReserved", "linked_record": true}, {"timestamp": "2023-11-06T17:30:54.394Z", "date_only": false, "value": "2023-11-06T17:30:54.394Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2023-44398", "record": "CVE-2023-44398", "field": "cveMetadata.datePublished", "linked_record": true}, {"timestamp": "2023-11-06T18:15:00Z", "date_only": false, "value": "2023-11-06T18:15:00Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2023-233", "record": "PYSEC-2023-233", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2023-12-22T10:06:49.495Z", "date_only": false, "value": "2023-12-22T10:06:49.495Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2023-44398 / GitHub_M", "record": "CVE-2023-44398", "field": "containers.cna.providerMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2024-01-02T15:20:59.435Z", "date_only": false, "value": "2024-01-02T15:20:59.435740Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2023-233", "record": "PYSEC-2023-233", "field": "modified", "linked_record": true}, {"timestamp": "2024-08-02T20:07:32.998Z", "date_only": false, "value": "2024-08-02T20:07:32.998Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2023-44398 / CVE", "record": "CVE-2023-44398", "field": "containers.adp.0.providerMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2025-02-26T21:14:54.618Z", "date_only": false, "value": "2025-02-26T21:14:54.618844Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 \u00b7 CVE-2023-44398 / CISA-ADP", "record": "CVE-2023-44398", "field": "containers.adp.1.metrics.0.other.content.timestamp", "linked_record": true}, {"timestamp": "2025-02-26T21:15:17.204Z", "date_only": false, "value": "2025-02-26T21:15:17.204Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2023-44398", "record": "CVE-2023-44398", "field": "cveMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2025-02-26T21:15:17.204Z", "date_only": false, "value": "2025-02-26T21:15:17.204Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2023-44398 / CISA-ADP", "record": "CVE-2023-44398", "field": "containers.adp.1.providerMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2025-02-26T21:25:26Z", "date_only": false, "value": "2025-02-26T21:25:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/5613", "record": "GHSA-HRW9-GGG3-3R4R", "field": "creation_timestamp", "uuid": "365b2a3d-1bbe-428c-9c3e-5cdcbd1d61fd", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-44398\n\ud83d\udd25 CVSS Score: 8.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, so earlier versions of Exiv2 are _not_ affected. The out-of-bounds write is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. This bug is fixed in version v0.28.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\ud83d\udccf Published: 2023-11-06T17:30:54.394Z\n\ud83d\udccf Modified: 2025-02-26T21:15:17.204Z\n\ud83d\udd17 References:\n1. https://github.com/Exiv2/exiv2/security/advisories/GHSA-hrw9-ggg3-3r4r\n2. https://github.com/Exiv2/exiv2/commit/e884a0955359107f4031c74a07406df7e99929a5\n3. https://security.gentoo.org/glsa/202312-06", "url": "https://t.me/DarkWebInformer_CVEAlerts/5613", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-12-29T21:01:14Z", "date_only": false, "value": "2025-12-29T21:01:14.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.blog/security/vulnerability-research/bugs-that-survive-the-heat-of-continuous-fuzzing/", "record": "GHSA-hrw9-ggg3-3r4r", "field": "creation_timestamp", "uuid": "a65a0b96-1292-43b1-b51e-72e57056342b", "url": "https://github.blog/security/vulnerability-research/bugs-that-survive-the-heat-of-continuous-fuzzing/"}], "metrics": {"as_of": "2026-11-09T22:38:35.932Z", "anchors": {"origin": {"timestamp": "2023-11-06T18:15:00Z", "date_only": false, "value": "2023-11-06T18:15:00Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2023-233", "record": "PYSEC-2023-233", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2023-11-06T18:15:00Z", "date_only": false, "value": "2023-11-06T18:15:00Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2023-233", "record": "PYSEC-2023-233", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2025-02-26T21:25:26Z", "date_only": false, "value": "2025-02-26T21:25:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/5613", "record": "GHSA-HRW9-GGG3-3R4R", "field": "creation_timestamp", "uuid": "365b2a3d-1bbe-428c-9c3e-5cdcbd1d61fd", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-44398\n\ud83d\udd25 CVSS Score: 8.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, so earlier versions of Exiv2 are _not_ affected. The out-of-bounds write is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. This bug is fixed in version v0.28.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\ud83d\udccf Published: 2023-11-06T17:30:54.394Z\n\ud83d\udccf Modified: 2025-02-26T21:15:17.204Z\n\ud83d\udd17 References:\n1. https://github.com/Exiv2/exiv2/security/advisories/GHSA-hrw9-ggg3-3r4r\n2. https://github.com/Exiv2/exiv2/commit/e884a0955359107f4031c74a07406df7e99929a5\n3. https://security.gentoo.org/glsa/202312-06", "url": "https://t.me/DarkWebInformer_CVEAlerts/5613", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 41310626.0, "hours": 11475.173888888889, "days": 478.13224537037036, "min_seconds": 41310626.0, "max_seconds": 41310626.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2023-11-06T18:15:00Z", "date_only": false, "value": "2023-11-06T18:15:00Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2023-233", "record": "PYSEC-2023-233", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2025-02-26T21:25:26Z", "date_only": false, "value": "2025-02-26T21:25:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/5613", "record": "GHSA-HRW9-GGG3-3R4R", "field": "creation_timestamp", "uuid": "365b2a3d-1bbe-428c-9c3e-5cdcbd1d61fd", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-44398\n\ud83d\udd25 CVSS Score: 8.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, so earlier versions of Exiv2 are _not_ affected. The out-of-bounds write is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. This bug is fixed in version v0.28.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\ud83d\udccf Published: 2023-11-06T17:30:54.394Z\n\ud83d\udccf Modified: 2025-02-26T21:15:17.204Z\n\ud83d\udd17 References:\n1. https://github.com/Exiv2/exiv2/security/advisories/GHSA-hrw9-ggg3-3r4r\n2. https://github.com/Exiv2/exiv2/commit/e884a0955359107f4031c74a07406df7e99929a5\n3. https://security.gentoo.org/glsa/202312-06", "url": "https://t.me/DarkWebInformer_CVEAlerts/5613", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 94969415.9327, "hours": 26380.393314638888, "days": 1099.1830547766203, "min_seconds": 94969415.9327, "max_seconds": 94969415.9327, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2023-11-06T18:15:00Z", "date_only": false, "value": "2023-11-06T18:15:00Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2023-233", "record": "PYSEC-2023-233", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-09T22:38:35.932Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 53658789.9327, "hours": 14905.21942575, "days": 621.05080940625, "min_seconds": 53658789.9327, "max_seconds": 53658789.9327, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-02-26T21:25:26Z", "date_only": false, "value": "2025-02-26T21:25:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/5613", "record": "GHSA-HRW9-GGG3-3R4R", "field": "creation_timestamp", "uuid": "365b2a3d-1bbe-428c-9c3e-5cdcbd1d61fd", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-44398\n\ud83d\udd25 CVSS Score: 8.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, so earlier versions of Exiv2 are _not_ affected. The out-of-bounds write is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. This bug is fixed in version v0.28.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\ud83d\udccf Published: 2023-11-06T17:30:54.394Z\n\ud83d\udccf Modified: 2025-02-26T21:15:17.204Z\n\ud83d\udd17 References:\n1. https://github.com/Exiv2/exiv2/security/advisories/GHSA-hrw9-ggg3-3r4r\n2. https://github.com/Exiv2/exiv2/commit/e884a0955359107f4031c74a07406df7e99929a5\n3. https://security.gentoo.org/glsa/202312-06", "url": "https://t.me/DarkWebInformer_CVEAlerts/5613", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-09T22:38:35.932Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}