PT-2017-2775 · Newsbeuter+3 · Newsbeuter+3

Jeriko One · Published 2017-08-18 · Updated 2020-10-21 · CVE-2017-12904

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Newsbeuter versions 0.7 through 2.9

Description The issue is related to improper neutralization of special elements used in an OS command in the bookmarking function. This allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.

Recommendations For Newsbeuter versions 0.7 through 2.9, consider disabling the bookmarking function until a patch is available to prevent exploitation. Restrict access to RSS items that may contain malicious shell code to minimize the risk of code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-943

Related Identifiers

ALT-PU-2017-2368

BDU:2017-02033

CVE-2017-12904

DLA-1061-1

DSA-3947-1

OPENSUSE-SU-2018_0166-1

USN-4585-1

Affected Products

Alt Linux

Newsbeuter

Suse

Ubuntu

References · 18

• https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307 · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2017-12904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12904 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-12904 · Vendor Advisory
• http://debian.org/security/2017/dsa-3947 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02033 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12904 · Vendor Advisory
• https://usn.ubuntu.com/4585-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4585-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14500 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-12904 · Security Note
• https://osv.dev/vulnerability/DSA-3947-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12904 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12904 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4585-1 · Vendor Advisory