PT-2019-8040 · Fs · Fs-Git

Publicado 2019-05-29 · Atualizado 2019-05-29 · CVE-2017-16087

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions fs-git versions prior to 1.0.2

Description The issue arises from the lack of sanitization of strings passed into the buildCommand method, leading to arbitrary code execution.

Recommendations Update to version 1.0.2 or later.

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2017-16087

GHSA-QR32-J4J6-3M7R

Produtos afetados

Fs-Git

Referências · 5

• https://github.com/vvakame/fs-git/commit/eb5f70efa5cfbff1ab299fa7daaa5de549243998 · Nota
• https://github.com/vvakame/fs-git/commit/eb5f70efa5cfbff1ab299fa7daaa5de549243998#diff-13b5b151431c7e7a17f273559ed212d5 · Nota
• https://npmjs.com/advisories/360 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16087 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qr32-j4j6-3m7r · Aviso do Fabricante