Bug 2181356 (CVE-2023-28686)

Summary:	CVE-2023-28686 dino: Insufficient message sender validation
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dino 0.4.2, dino 0.3.2, dino 0.2.3, dino 0.4.1-14-gef8fb0e9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-03-24 00:06:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2181357
Bug Blocks:

Description Pedro Sampaio 2023-03-23 20:09:05 UTC

### Affected software

Dino (Instant Messenger) - https://dino.im/

### Severity

Medium (5.3): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Affected versions
- Release version 0.4.0 and 0.4.1
- Release version 0.3.0 and 0.3.1
- Release version 0.2.2 and earlier
- Nightly version 0.4.1-13-g6690d8e4 and earlier

### Fixed versions
- Release version 0.4.2
- Release version 0.3.2
- Release version 0.2.3
- Nightly version 0.4.1-14-gef8fb0e9

### Description

It was discovered that when a Dino client receives a specifically
crafted message from an unauthorized sender, it would use information
from that message to add, update or remove entries in the user's
personal bookmark store without requiring further user interaction.

This vulnerability allows the attacker to change how group chats are
displayed or to force a user to join or leave an attacker-selected
groupchat. This can be used to trick the user to reveal sensitive
information to the attacker.

### Advice

All deployments should upgrade to a fixed version or apply the patch
from commit ef8fb0e94ce79d5fde2943e433ad0422eb7f70ec.

### Credits

Many thanks to Kim Alvefur for discovering and reporting this issue.

### Links

- https://dino.im/security/cve-2023-28686/
- https://github.com/dino/dino/commit/ef8fb0e
- https://github.com/dino/dino/releases/tag/v0.4.2
- https://github.com/dino/dino/releases/tag/v0.3.2
- https://github.com/dino/dino/releases/tag/v0.2.3
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28686

Comment 1 Pedro Sampaio 2023-03-23 20:09:18 UTC

Created dino tracking bugs for this issue:

Affects: fedora-all [bug 2181357]

Comment 2 Product Security DevOps Team 2023-03-24 00:06:30 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.