CVE-2019-10778

Name of the Vulnerable Software and Affected Versions devcert-sanscache versions prior to 0.4.7

Description The issue allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable commonName, which is controlled by user input, is used as part of the exec function without any sanitization.

Recommendations For devcert-sanscache versions prior to 0.4.7, update to version 0.4.7 or later to resolve the issue. As a temporary workaround, consider disabling the use of the exec function with user-controlled input until a patch is available. Restrict access to the commonName variable to minimize the risk of exploitation.