CVE-2023-42183

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-12-15 · updated 2026-06-17
Weakness: CWE-116

Description

lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick.

Affected products

Lockss Classic Lockss Daemon: before 1.77.3 — fixed in 1.77.3

How to fix

Upgrade to a fixed version: Lockss Classic Lockss Daemon 1.77.3. Check the vendor advisory for mitigations.

References

https://github.com/lockss/lockss-daemon/security/advisories/GHSA-mgqj-hphf-9588
https://github.com/lockss/lockss-daemon/security/advisories/GHSA-mgqj-hphf-9588

Get alerted when CVE-2023-42183 or the next vulnerability affects your stack