CVE-2019-1010306 - Slanger 0.6.0 is affected by: Remote Code Execution (RCE)

Back Back to CVE browser

CRITICAL

Slanger 0.6.0 is affected by: Remote Code Execution (RCE)

Published Jul 15, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 4.04%

Description

Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.

Affected products

Vendor Slanger Product Slanger Default
n/a
- Version
  0.6.0 [fixed: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3]
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Slanger

n/a

Version	Status	Constraints
0.6.0 [fixed: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3]	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (5)

https://github.com/advisories/GHSA-rg32-m3hf-772v
Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/slanger/CVE-2019-1010306.yml
https://github.com/stevegraham/slanger/pull/238
https://github.com/stevegraham/slanger/pull/238/commits/5267b455caeb2e055cccf0d2b6a22727c111f5c3
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-1010306

Link	Providers	Tags
https://github.com/advisories/GHSA-rg32-m3hf-772v		Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/slanger/CVE-2019-1010306.yml
https://github.com/stevegraham/slanger/pull/238
https://github.com/stevegraham/slanger/pull/238/commits/5267b455caeb2e055cccf0d2b6a22727c111f5c3		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-1010306