CVE-2024-53848 – check-jsonschema default caching for remote schemas allows for cache confusion

https://notcve.org/view.php?id=CVE-2024-53848

29 Nov 2024 — check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, they can insert their own schema into the cache and it will be picked up and used instead... • https://github.com/python-jsonschema/check-jsonschema/commit/c52714b85e6725b1b24516fbdedacb333b939152 • CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data •