Approved changes feed: RSS · Atom
cpe:2.3:a:islandora:crayfish:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Islandora (f8893ded-ebb3-5082-bba2-2674d5be7faa) |
|---|---|
| Product | Crayfish (b7890591-654d-58ef-862c-7d1c72375ab8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-25286 |
vulnerable | 2026-06-08 07:12:51.094138 |
Crayfish allows Remote Code Execution via Homarus Authorization header
CRITICAL (9.8)
Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in `islandora/crayfish:4.1.0`. Some workarounds are available. The exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Alternatively or additionally, configure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.
Published: 2025-02-13T00:36:55.558Z
Updated: 2025-02-13T15:08:05.551Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.