GCVE - cpe:2.3:a:schollz:croc:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:schollz:croc:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Schollz (`4f55e7b0-9f10-5337-9ec2-519164e90747`)
Product	Croc (`ead5bd1d-958a-5e9d-8882-100e65d4eee4`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/schollz/croc`	purl2cpe	2026-06-01 10:15:03.874218
`pkg:golang/github.com/schollz/croc`	purl2cpe	2026-06-01 10:15:03.874221
`pkg:sourceforge/croc.mirror`	purl2cpe	2026-06-01 10:15:03.874224

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-43621`	vulnerable	2026-06-08 06:12:37.525982	Details available An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments. Published: 2023-09-20T00:00:00.000Z Updated: 2024-09-24T18:31:10.115Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2023/09/08/2 https://github.com/schollz/croc/issues/598 http://www.openwall.com/lists/oss-security/2023/09/21/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-43620`	vulnerable	2026-06-08 06:12:37.525517	Details available An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver. Published: 2023-09-20T00:00:00.000Z Updated: 2024-09-24T19:16:40.037Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2023/09/08/2 https://github.com/schollz/croc/issues/595 http://www.openwall.com/lists/oss-security/2023/09/21/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-43619`	vulnerable	2026-06-08 06:12:37.525030	Details available An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file. Published: 2023-09-20T00:00:00.000Z Updated: 2024-09-24T19:34:29.648Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2023/09/08/2 https://github.com/schollz/croc/issues/593 http://www.openwall.com/lists/oss-security/2023/09/21/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-43618`	vulnerable	2026-06-08 06:12:37.524637	Details available An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message. Published: 2023-09-20T00:00:00.000Z Updated: 2024-09-25T13:52:42.662Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2023/09/08/2 https://github.com/schollz/croc/issues/597 http://www.openwall.com/lists/oss-security/2023/09/21/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-43617`	vulnerable	2026-06-08 06:12:37.524025	Details available An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name. Published: 2023-09-20T00:00:00.000Z Updated: 2024-09-24T19:36:31.696Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2023/09/08/2 https://github.com/schollz/croc/issues/596 http://www.openwall.com/lists/oss-security/2023/09/21/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-43616`	vulnerable	2026-06-08 06:12:37.523182	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Croc

Notes

PURL mappings

Vulnerability references

Contribute