PT-2018-6070 · Growl · Growl

Evilpacket + 1 · Publicado 2018-06-04 · Atualizado 2019-10-09 · CVE-2017-16042

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: growl versions prior to 1.10.2

Description: The issue allows for arbitrary command execution due to improper input sanitization before passing it to a shell command.

Recommendations: Update to version 1.10.2 or later.

Correção

Code Injection

OS Command Injection

Enumeração de Fraquezas

CWE-94

CWE-78

Identificadores relacionados

AZL-44547

CVE-2017-16042

GHSA-QH2H-CHJ9-JFFQ

Produtos afetados

Growl

Referências · 16

• https://github.com/tj/node-growl · Nota
• https://github.com/tj/node-growl/commit/d71177d5331c9de4658aca62e0ac921f178b0669 · Nota
• https://github.com/tj/node-growl/issues/60 · Nota
• https://github.com/tj/node-growl/pull/61 · Correção
• https://github.com/tj/node-growl/pull/62 · Nota
• https://npmjs.com/advisories/146 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16042 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-16042 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16042 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qh2h-chj9-jffq · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16042 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-16042 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-16042 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-44547 · Aviso do Fabricante
• https://nodesecurity.io/advisories/146 · Nota