PT-2022-10314 · Unknown · Es128 Ssl-Utils

Published 2022-06-01 · Updated 2022-06-09 · CVE-2021-34080

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions es128 ssl-utils version 1.0.0

Description The issue allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest() and the createCert() functions.

Recommendations For es128 ssl-utils version 1.0.0, as a temporary workaround, consider disabling the createCertRequest() and createCert() functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-34080

GHSA-552J-PV39-F3JF

Affected Products

Es128 Ssl-Utils

References · 5

• 🔥 https://advisory.checkmarx.net/advisory/CX-2021-4782 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-34080 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34080 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-552j-pv39-f3jf · Vendor Advisory
• https://github.com/es128/ssl-utils · Note