PT-2017-18538
CVE-2017-8799
·
تاريخ النشر
2017-05-05
·
تاريخ التحديث
2019-10-03
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
iRODS versions prior to 4.1.11
iRODS versions prior to 4.2.1
Description
The issue allows execution of untrusted input via
igetwild in iRODS, enabling other users, potentially anonymous, to execute remote shell commands through iRODS virtual pathnames. This can be exploited by retrieving a virtual iRODS pathname containing a semicolon via igetwild, which, being a Bash script, executes the part of the pathname following the semicolon in the user's shell.Recommendations
For versions prior to 4.1.11, update to version 4.1.11 or later.
For versions prior to 4.2.1, update to version 4.2.1 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾