Racket up to 8.1 Setting external reference

Summaryinfo

A vulnerability, which was classified as critical, was found in Racket up to 8.1. Impacted is an unknown function of the component Setting Handler. Such manipulation leads to external reference. This vulnerability is referenced as CVE-2021-32773. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Racket up to 8.1. Affected by this issue is some unknown functionality of the component Setting Handler. The manipulation with an unknown input leads to a external reference vulnerability. Using CWE to declare the problem leads to CWE-610. The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules instead of their intended dependencies. This could allow system functions to be controlled by the attacker, giving access to facilities intended to be restricted. This problem is fixed in Racket version 8.2. A workaround is available, depending on system settings. For systems that provide arbitrary Racket evaluation, external sandboxing such as containers limit the impact of the problem. For multi-user evaluation systems, such as the `handin-server` system, it is not possible to work around this problem and upgrading is required.

The weakness was published 01/27/2023 as GHSA-cgrw-p7p7-937c. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2021-32773 since 05/12/2021. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 8.2 eliminates this vulnerability. Applying the patch 6ca4ffeca1e5877d44f835760ad89f18488d97e1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Racket

Version

• 8.0
• 8.1

License

• open-source

Website

• Product: https://github.com/racket/racket/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion