Jabra Direct: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Summary

Product

Vulnerabilities 4

• Critical 9.8
  CVE-2023-24531

  Output of "go env" does not sanitize values in cmd/go

  Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting ne…

  Go toolchain cmd/go katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi Go
  Jul 2, 2024
• Critical 9.8
  CVE-2023-29827 Scanner template

  ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be …

  node-ejs Debian
  May 4, 2023
• Critical 9.8
  CVE-2024-24790

  Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

  Go standard library net/netip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 5, 2024
• Critical 9.1
  CVE-2025-22871

  Request smuggling due to acceptance of invalid chunked data in net/http

  The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Packagist Go
  Apr 8, 2025

Revision history

1. 2026-05-27 #1

   Initiale Fassung

References

• Jabra Release notes for Direct vom 2026-05-27
  https://www.jabra.com/de-de/support/release-notes/release-note-jabra-direct