PT-2020-7077 · Statusnet · Statusnet

Josh Bressers · Published 2020-02-07 · Updated 2020-02-11 · CVE-2010-4658

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions statusnet versions through 2010

Description The issue allows attackers to spoof syslog messages via newline injection attacks.

Recommendations For statusnet versions through 2010, consider restricting access to the syslog functionality until a patch is available. As a temporary workaround, avoid using newline characters in input to minimize the risk of exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2010-4658

Affected Products

Statusnet

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-4658 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-4658 · Vendor Advisory
• https://openwall.com/lists/oss-security/2011/01/25/13 · Note
• https://t.me/cibsecurity/9698 · Telegram Post