{"id":"CVE-2023-42183","details":"lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick.","aliases":["GHSA-mgqj-hphf-9588"],"modified":"2026-08-12T14:51:17.361572Z","published":"2023-12-15T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42183.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42183.json"},{"type":"ADVISORY","url":"https://github.com/lockss/lockss-daemon/security/advisories/GHSA-mgqj-hphf-9588"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42183"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lockss/lockss-daemon","events":[{"introduced":"0"},{"fixed":"fa3b512004d4abe1a1c7de16e45490909fb8ae89"}],"database_specific":{"cpe":"cpe:2.3:a:lockss:classic_lockss_daemon:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.77.3"}],"source":["DESCRIPTION","CPE_RANGE"]}}],"versions":["release-candidate_1-77-b2","release-candidate_1-77-b1","release-candidate_1-76-b1","release-candidate_1-75-b1","release-candidate_1-74-b1","release-candidate_1-73-b1","release-candidate_1-72-b1","release_candidate_1-70-b4","release-candidate_1-70-b1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-42183.json","vanir_signatures_modified":"2026-08-12T14:51:17Z","vanir_signatures":[{"source":"https://github.com/lockss/lockss-daemon/commit/fa3b512004d4abe1a1c7de16e45490909fb8ae89","target":{"file":"src/org/lockss/util/XStreamSerializer.java","function":"convertAnother"},"deprecated":false,"digest":{"length":472,"function_hash":"78105782545441573290025444165544754049"},"id":"CVE-2023-42183-2fc4364f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/lockss/lockss-daemon/commit/fa3b512004d4abe1a1c7de16e45490909fb8ae89","target":{"file":"src/org/lockss/util/XStreamSerializer.java","function":"init"},"deprecated":false,"digest":{"length":1497,"function_hash":"293717328863438803095393032824288609507"},"id":"CVE-2023-42183-307f09c5","signature_type":"Function"},{"digest":{"function_hash":"221347515604444174158561154025210479869","length":36},"id":"CVE-2023-42183-38b3468d","signature_type":"Function","signature_version":"v1","source":"https://github.com/lockss/lockss-daemon/commit/fa3b512004d4abe1a1c7de16e45490909fb8ae89","target":{"file":"src/org/lockss/util/XStreamSerializer.java","function":"useXStream11XmlFriendlyMapper"},"deprecated":false},{"target":{"function":"createUnmarshallingContext","file":"src/org/lockss/util/XStreamSerializer.java"},"deprecated":false,"digest":{"function_hash":"256778027088298660447438244258113615184","length":148},"id":"CVE-2023-42183-75d1a257","signature_type":"Function","signature_version":"v1","source":"https://github.com/lockss/lockss-daemon/commit/fa3b512004d4abe1a1c7de16e45490909fb8ae89"},{"deprecated":false,"digest":{"function_hash":"130458012983939392062716386429971744489","length":122},"id":"CVE-2023-42183-a25d93af","signature_type":"Function","signature_version":"v1","source":"https://github.com/lockss/lockss-daemon/commit/fa3b512004d4abe1a1c7de16e45490909fb8ae89","target":{"file":"src/org/lockss/util/XStreamSerializer.java","function":"createMarshallingContext"}},{"source":"https://github.com/lockss/lockss-daemon/commit/fa3b512004d4abe1a1c7de16e45490909fb8ae89","target":{"file":"src/org/lockss/util/XStreamSerializer.java","function":"LockssReferenceByXPathMarshallingStrategy"},"deprecated":false,"digest":{"function_hash":"180959856393265968175379815515506203376","length":110},"id":"CVE-2023-42183-e9abecf2","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["139324818434813149908257414435227975984","171985205994857646898618812530589780457","128227567267851828999491947320642967857","314074925418935914151646167109117823538","105805845584482195921507411168598300623","261191425755482881597815297767534035520","123353786268930425475127149287792618851","221605298167975733019241229503979564952","338139489625069368404405961192451037286","149203598454283884253934235556154311087","120792415584805788353091758995067919834","87940771184629901037168636135707137104","203606861363600950147011211450139844450","129581120264496321122019813242515191693","146304379988194024310136298039706173301","12480355705992355534195476639150346355","34444706322066398338941355138756820242","330790466228003312580589352429235832195","153637959804692393057458794175839386099","309033937140245746228899289044788946189","42706294093986551311431488170915263924","258988434303695669049256823266026813909","319381037982132198400005531168475465721","237898653591111693293735420159897675826","226922162861987905312110469124961813643","298975564525296399023403661748215350770","288386123758911631500259524967662241570","178623268279197225035129528011225329926","159511375396531456006581847881076795270","270597280780856904676359817462886952290","236871539367529047040701985048852444414","93161672260924647700553809033077818479","133163440458114391842253496749536840530","188839614358428637025612679920592956317","81086943658381477749612303138834038843","184922073783698866006255436405837201148","200921782318533446757941888208280613930","236503205135208471313140932011228099704","300413547368023396047685966835049403177","206916590672821999614910668811549392457","324372775074939212774906540753685224859","216493080320508125766207299355495757716","96296558294426443640741519375241573623","297073027736066523833861989271066623001","133964546938193117830085465074513163756","252653262379116847107711070342771879148","192741782857479563833812624211614317396","80176999686909802898208214607422453157","318599926352912928511048051636193358319","214476568356588802197369267992757012916","223708221618253611596720231154824337664","24365331742230917214509085398193709388","269781065372208446169070967054103292558","45716803818251480120388670724478757835","15398502817060612564596918192324066120","273161367066438107763608500429836717830","258304056251005468719601308930759323793","36311540177821711991616091295819180260","129870369077219123624626651674367405068","3752576144760603271683292673354610075","197151663191992745927710729399413283013","299978691998077320352739675159115875192","334080463372197071557178320749635787469","313248196788030007041618810684078035112","339474466789139239287420851750845060719","163870512505097335158681636859100847944","107884321815839332386201513648884952674","226315197830502253016693042860312139864","88041907633785768717486410809051765931","222166082185451185338091566717892398064","315079875039122085900120746138409761140","121664146264655555650500171437553697692","235370931357363495770789693082643650411","121255808765935050723263919259273234959","186902410055971628595877997596433195444","269149050382483847636024917418663346033","31380993915399340483648739615898492314","203465155788153897151160789330871263171","124792224343326584945878285842258729576","325869357010398970759326267646818780742","129991379870334890368180527303278613589","165251622423396728155541431123200984307","42204964169937230440606503783266330686","47478716334189668590903186905866835543","245160135126150221489657729993797643644","279669281642836205564706104864165988016","76608199305778900570079020539182021708","209996211129501122896335028442144312460","236061230862772581393220896842372934819","287369000501004941210342306282887586591","170661579821471569059493233764834975521"],"threshold":0.9},"id":"CVE-2023-42183-ff2d8ada","signature_type":"Line","signature_version":"v1","source":"https://github.com/lockss/lockss-daemon/commit/fa3b512004d4abe1a1c7de16e45490909fb8ae89","target":{"file":"src/org/lockss/util/XStreamSerializer.java"}},{"source":"https://github.com/lockss/lockss-daemon/commit/fa3b512004d4abe1a1c7de16e45490909fb8ae89","target":{"file":"src/org/lockss/util/XStreamSerializer.java","function":"LockssReferenceByXPathMarshaller"},"deprecated":false,"digest":{"function_hash":"112507763979576327066204412776334619511","length":176},"id":"CVE-2023-42183-ffd23765","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}