CVE-2023-41899

Advisory

Homeassistant 2023.9.0 includes a fix for CVE-2023-41899: In affected versions the 'hassio.addon_stdin' is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke any Supervisor REST API endpoints with a POST request. An attacker able to exploit will be able to control the data dictionary, including its addon and input key/values.
https://github.com/home-assistant/core/pull/99232

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp
• https://github.com/home-assistant/core/security/advisories/GHSA-4r74-h49q-rr3h
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41899