CVE-2023-41886

OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.

References

Affected packages

Debian:12 / openrefine

Package

Name: openrefine
Purl: pkg:deb/debian/openrefine?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6.2-2+deb12u2

Affected versions

3.*

3.6.2-2

3.6.2-2+deb12u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/openrefine/openrefine

Affected ranges

Type: GIT
Repo: https://github.com/openrefine/openrefine
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2de1439f5be63d9d0e89bbacbd24fa28c8c3e29d

Affected versions

1.*

1.1

2.*

2.6-alpha.2

2.6-alpha1

2.6-beta.1

2.6-rc.2

2.7

2.7-rc.1

2.7-rc.2

2.8

3.*

3.0

3.0-beta

3.0-rc.1

3.1

3.1-beta

3.2

3.2-beta

3.3

3.3-beta

3.3-rc1

3.4-beta

3.5-beta1

3.7-beta2

v2.*

v2.6-rc1