Threats tagged 'brew-keeper-commander-cve-2025-68131'

A vulnerability in keeper-commander's CBORDecoder allows information disclosure when the decoder instance is reused across multiple decode operations. Values tagged as shareable (tag 28) persist in memory and can be accessed by subsequent messages using the sharedref tag (29), enabling an attacker-controlled message to read data from previously decoded messages. This occurs because the shareables list is not cleared between decode calls. The issue affects both the C extension and pure Python implementations. Fixed versions are 17.1.13 and 17.2.1_1.