GHSA-8wr4-2wm6-w3pr · 深刻度： medium · エコシステム： pip — B2 Command Line Tool TOCTOU application key disclosure
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapping) in a local database file (`$XDG_CONFIG_HOME/b2/account_info`, `~/.b2_account_info` or a user-defined path) when `b2 authorize-account` is first run. This happens regardless of whether a valid key is provided or not. When first created, the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory is readable by a local attacker and the user did not yet run `b2 authorize-account` then during the brief period between file creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information has been saved to it. Users that have not yet run `b2 authorize-account` should upgrade to B2 Command-Line Tool v3.2.1 before running it. Users that have run `b2 authorize-account` are safe if at the time of the file creation no other local users had read access to the local configuration file. Users that have run `b2 authorize-account` where the designated path could be opened by another local user should upgrade to B2 Command-Line Tool v3.2.1 and remove the database and regenerate all application keys. Note that `b2 clear-account` does not remove the database file and it should not be used to ensure that all open handles to the file are invalidated. If B2 Command-Line Tool cannot be upgraded to v3.2.1 due to a dependency conflict, a binary release can be used instead. Alternatively a new version could be installed within a virtualenv, or the permissions can be changed to prevent local users from opening the database file.
総合評価: CVE-2022-23653 は低リスク（22.5/100）。CVSS 深刻度は中。悪用される可能性が高い（EPSS 0.20%、10 パーセンタイル） 推奨対応: 悪用情報と EPSS の推移を監視し、必要に応じて優先度を見直してください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.04% | 0.20% | +0.16% |
| 2 | 2025-04-06 | 0.07% | 0.04% | -0.03% |
| 3 | 2025-03-17 | — | 0.07% | — |
EPSS の全履歴 （全 5 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 4.7 | 3.1 | MEDIUM |
|
1.0 | 3.6 | [email protected] |
| 4.7 | 3.1 | MEDIUM |
|
1.0 | 3.6 | [email protected] |
| 1.9 | 2.0 | LOW |
|
3.4 | 2.9 | [email protected] |
GHSA-8wr4-2wm6-w3pr · 深刻度： medium · エコシステム： pip — B2 Command Line Tool TOCTOU application key disclosure
| ベンダー | 製品 | バージョン | 生の CPE |
|---|---|---|---|
| backblaze | b2_command_line_tool | <= 3.2.0 | cpe:2.3:a:backblaze:b2_command_line_tool:*:*:*:*:*:linux:*:* |
| backblaze | b2_command_line_tool | <= 3.2.0 | cpe:2.3:a:backblaze:b2_command_line_tool:*:*:*:*:*:mac:*:* |
| URL | タグ |
|---|---|
| https://github.com/Backblaze/B2_Command_Line_Tool/commit/c74029f9f75065e8f7e3c3ec8e0a23fb8204feeb | Patch Third Party Advisory |
| https://github.com/Backblaze/B2_Command_Line_Tool/security/advisories/GHSA-8wr4-2wm6-w3pr | Third Party Advisory |