x/vulndb: potential Go vuln in github.com/turt2live/matrix-media-repo: CVE-2023-41318

[GoVulnBot]

CVE-2023-41318 references github.com/turt2live/matrix-media-repo, which may be a Go module.

Description:
matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with Content-Disposition: inline upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits 77ec235 and bf8abdd fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the Content-Disposition header returned by matrix-media-repo as a workaround.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-41318
• JSON: https://github.com/CVEProject/cvelist/tree/61358e11be8c74e2b1cd7a111587263cc1634d58/2023/41xxx/CVE-2023-41318.json
• advisory: GHSA-5crw-6j7v-xc72
• fix: t2bot/matrix-media-repo@77ec235
• fix: t2bot/matrix-media-repo@bf8abdd
• web: https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script
• Imported by: https://pkg.go.dev/github.com/turt2live/matrix-media-repo?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/turt2live/matrix-media-repo
      vulnerable_at: 1.3.0
      packages:
        - package: matrix-media-repo
description: |-
    matrix-media-repo is a highly customizable multi-domain media repository for the
    Matrix chat ecosystem. In affected versions an attacker could upload a malicious
    piece of media to the media repo, which would then be served with
    `Content-Disposition: inline` upon download. This vulnerability could be
    leveraged to execute scripts embedded in SVG content. Commits `77ec235` and
    `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should
    upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should
    override the `Content-Disposition` header returned by matrix-media-repo as a
    workaround.
cves:
    - CVE-2023-41318
references:
    - advisory: https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-5crw-6j7v-xc72
    - fix: https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137
    - fix: https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59
    - web: https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script

[timothy-king]

Duplicate of #2053