PT-2022-8026 · Ecto · Ecto

Tlux · Published 2022-04-12 · Updated 2025-04-09 · CVE-2017-20166

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ecto version 2.2.0

Description The issue is related to a lack of protection mechanism in the interaction between is nil and raise functions. Specifically, Ecto will not raise on queries with non-explicit nil comparisons, unless they are checked with is nil.

Recommendations For Ecto version 2.2.0, consider adding explicit nil checks using the is nil function to ensure queries raise appropriately when encountering nil values. As a temporary workaround, review and modify queries to include explicit nil comparisons to minimize potential issues.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2017-20166

GHSA-2XXX-FHC8-9QVQ

GHSA-4R2F-6FM9-2QGH

Affected Products

Ecto

References · 12

• 🔥 https://github.com/elixir-ecto/ecto/pull/2125 · Exploit
• 🔥 https://groups.google.com/forum/#!topic/elixir-ecto/0m4NPfg_MMU · Exploit
• https://github.com/elixir-ecto/ecto/commit/db55b0cba6525c24ebddc88ef9ae0c1c00620250 · Patch
• https://osv.dev/vulnerability/GHSA-4r2f-6fm9-2qgh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2xxx-fhc8-9qvq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-20166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-20166 · Security Note
• https://github.com/elixir-ecto/ecto · Note
• https://github.com/advisories/GHSA-2xxx-fhc8-9qvq · Note
• https://t.me/cvenotify/41682 · Telegram Post
• https://t.me/cvenotify/118494 · Telegram Post
• https://groups.google.com/forum/#%21topic/elixir-ecto/0m4NPfg_MMU · Note