PatchTheCVECVE-2022-23653: B2 Command Line Tool is the official command line tool for the backblaze cloud storage service
CVE-2022-23653 is a medium-severity flaw (CVSS 4.7) affecting b2 command line tool, b2 command line tool. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapping) in a local database file (`$XDG_CONFIG_HOME/b
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.7 (Medium) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 89%) |
| CISA exploited list | No |
| Weakness | CWE-367 |
| Published | 2022-02-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-23653?
b2 command line tool: upgrade to newer than 3.2.0; b2 command line tool: upgrade to newer than 3.2.0. Exact commands for each OS are on this page.
Is CVE-2022-23653 being exploited?
CVE-2022-23653 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-23653 affect?
CVE-2022-23653 affects b2 command line tool, b2 command line tool. Severity is medium (CVSS 4.7). B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, c
How urgent is CVE-2022-23653?
Priority 19/100. No elevated risk signals yet.