{"metadata": {"vulnerability": "cve-2023-39523", "count": 21, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 13}}, "data": [{"timestamp": "2023-08-03T16:27:36.262Z", "date_only": false, "value": "2023-08-03T16:27:36.262Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2023-39523", "field": "cveMetadata.dateReserved"}, {"timestamp": "2023-08-07T16:09:20Z", "date_only": false, "value": "2023-08-07T16:09:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/aboutcode-org/scancode.io/security/advisories/GHSA-2ggp-cmvm-f62f", "record": "CVE-2023-39523", "field": "creation_timestamp", "uuid": "3ee44e56-053d-4e57-9631-69f5d7a164ff", "url": "https://github.com/aboutcode-org/scancode.io/security/advisories/GHSA-2ggp-cmvm-f62f"}, {"timestamp": "2023-08-07T20:55:46.855Z", "date_only": false, "value": "2023-08-07T20:55:46.855Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2023-39523", "field": "cveMetadata.datePublished"}, {"timestamp": "2023-08-07T20:55:46.855Z", "date_only": false, "value": "2023-08-07T20:55:46.855Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2023-39523", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2023-08-07T21:15:00Z", "date_only": false, "value": "2023-08-07T21:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2023-39523", "record": "GSD-2023-39523", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2023-08-07T21:15:09Z", "date_only": false, "value": "2023-08-07T21:15:09Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2GGP-CMVM-F62F", "record": "GHSA-2GGP-CMVM-F62F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2023-08-07T21:15:09.553Z", "date_only": false, "value": "2023-08-07T21:15:09.553", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-39523", "record": "FKIE_CVE-2023-39523", "field": "published"}, {"timestamp": "2023-08-08T00:13:38Z", "date_only": false, "value": "2023-08-08T00:13:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/67928", "record": "CVE-2023-39523", "field": "creation_timestamp", "uuid": "6f7aeb35-8686-4cd1-80ca-b3f24caabc46", "content": "\u203c CVE-2023-39523 \u203c\n\nScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible command injection vulnerability in the docker fetch process as it allows to append malicious commands in the `docker_reference` parameter.In the function `scanpipe/pipes/fetch.py:fetch_docker_image` the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`. However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of `docker://;`, it would allow appending malicious commands.Version 32.5.1 contains a patch for this issue. The `docker_reference` input should be sanitized to avoid command injections and, as a workaround, one may avoid creating commands with user controlled input directly.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/67928"}, {"timestamp": "2023-08-09T14:41:23Z", "date_only": false, "value": "2023-08-09T14:41:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2GGP-CMVM-F62F", "record": "GHSA-2GGP-CMVM-F62F", "field": "published"}, {"timestamp": "2023-08-09T14:41:23Z", "date_only": false, "value": "2023-08-09T14:41:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2GGP-CMVM-F62F", "record": "GHSA-2GGP-CMVM-F62F", "field": "modified"}, {"timestamp": "2023-08-11T18:12:00Z", "date_only": false, "value": "2023-08-11T18:12Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2023-39523", "record": "GSD-2023-39523", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-08-28T22:47:21Z", "date_only": false, "value": "2023-08-28T22:47:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/MrVGunz/877", "record": "CVE-2023-39523", "field": "creation_timestamp", "uuid": "cd340e64-a6dd-412e-8331-de5315642032", "content": "CVE-2023-39523 : Command Injection in docker fetch process\n\nPossible command injection in the docker pull process as it allows malicious commands to be added to the docker_reference parameter.\n\n PoC : https://github.com/nexB/scancode.io/security/advisories/GHSA-2ggp-cmvm-f62f", "url": "https://t.me/MrVGunz/877"}, {"timestamp": "2023-12-13T01:20:33.736Z", "date_only": false, "value": "2023-12-13T01:20:33.736825Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2023-39523", "record": "GSD-2023-39523", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-02T18:10:21.185Z", "date_only": false, "value": "2024-08-02T18:10:21.185Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2023-39523", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-10-03T15:59:46.990Z", "date_only": false, "value": "2024-10-03T15:59:46.990419Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2023-39523", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2024-10-03T15:59:46.990Z", "date_only": false, "value": "2024-10-03T15:59:46.990419Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-39523", "record": "FKIE_CVE-2023-39523", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-10-03T16:00:56.672Z", "date_only": false, "value": "2024-10-03T16:00:56.672Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2023-39523", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-10-03T16:00:56.672Z", "date_only": false, "value": "2024-10-03T16:00:56.672Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2023-39523", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T06:12:30.937Z", "date_only": false, "value": "2026-06-17T06:12:30.937", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-39523", "record": "FKIE_CVE-2023-39523", "field": "lastModified"}, {"timestamp": "2026-07-07T11:45:21.905Z", "date_only": false, "value": "2026-07-07T11:45:21.905903Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-1904", "record": "PYSEC-2026-1904", "field": "published"}, {"timestamp": "2026-07-07T17:25:21.704Z", "date_only": false, "value": "2026-07-07T17:25:21.704154Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-1904", "record": "PYSEC-2026-1904", "field": "modified"}]}