id: PYSEC-2022-46
details: OnionShare is an open source tool that lets you securely and anonymously
  share files, host websites, and chat with friends using the Tor network. In affected
  versions authenticated users (or unauthenticated in public mode) can send messages
  without being visible in the list of chat participants. This issue has been resolved
  in version 2.5.
affected:
- package:
    name: onionshare-cli
    ecosystem: PyPI
    purl: pkg:pypi/onionshare-cli
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: "2.5"
  versions:
  - "2.3"
  - 2.3.1
  - 2.3.2
  - 2.3.3
references:
- type: WEB
  url: https://github.com/onionshare/onionshare/releases/tag/v2.5
- type: ADVISORY
  url: https://github.com/onionshare/onionshare/security/advisories/GHSA-99p8-9p2c-49j4
aliases:
- CVE-2022-21695
- GHSA-99p8-9p2c-49j4
modified: "2022-03-09T00:16:43.452903Z"
published: "2022-01-18T22:15:00Z"