IT

Tracker / CVE-2019-5443

CVE-2019-5443

High 7.8

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.

Affected products and versions

haxx curl · … → 7.65.1
netapp oncommand_insight
netapp oncommand_unified_manager · 7.3 → …
netapp oncommand_unified_manager · 9.5 → …
netapp oncommand_workflow_automation
netapp snapcenter
oracle enterprise_manager_ops_center
oracle http_server
oracle mysql_server · 5.0.0 → 5.7.27
oracle mysql_server · 8.0.0 → 8.0.17
oracle oss_support_tools

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References