CVE-2023-6601

What it actually does

The flaw in the HLS demuxer allows bypassing of unsafe file extension checks, enabling the triggering of arbitrary demuxers through base64-encoded data URIs with appended file extensions.

Why it matters to the business

Organizations relying on media processing libraries face elevated risk of system compromise or unauthorized code execution when handling untrusted streams, which can disrupt operations and expose sensitive data.

How an attack unfolds

An attacker crafts input containing a base64-encoded data URI appended with a specific extension to evade extension validation in the HLS demuxer, causing the library to invoke an unintended demuxer on attacker-controlled content.

How to fix it

Upgrade affected packages to the listed fixed versions, specifically openssl 1.0.1f-1ubuntu2.20 on Ubuntu 14.04 LTS and openssl 1.0.2g-1ubuntu4.4 on Ubuntu 16.04 LTS.

How to confirm the fix worked

Verify package versions match the fixed releases, test processing of sample data URIs to confirm extension checks are enforced, and review changelog entries for the demuxer updates.

Typical attack path

1. Locate an application ingesting untrusted HLS or media content via the vulnerable demuxer.
2. Construct a data URI payload encoded in base64 and appended with a bypass extension.
3. Embed the URI in an HLS playlist or media file delivered to the target.
4. Trigger processing to activate an arbitrary demuxer and execute malicious logic.

How to detect it

Review application logs for unusual demuxer selection or errors during HLS processing, inspect inbound media files or playlists containing data URIs, and correlate with process execution anomalies.

What your security team should do

• Apply the specified package upgrades immediately across all Ubuntu 14.04 and 16.04 systems.
• Scan inventories for any FFmpeg or media library usage and prioritize updates.
• Implement input sanitization and sandboxing for media processing workflows.
• Monitor EPSS trends and reassess if exploit maturity increases.