Tracker / CVE-2019-5443
CVE-2019-5443
High 7.8
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Affected products and versions
| haxx | curl · … → 7.65.1 |
|---|---|
| netapp | oncommand_insight |
| netapp | oncommand_unified_manager · 7.3 → … |
| netapp | oncommand_unified_manager · 9.5 → … |
| netapp | oncommand_workflow_automation |
| netapp | snapcenter |
| oracle | enterprise_manager_ops_center |
| oracle | http_server |
| oracle | mysql_server · 5.0.0 → 5.7.27 |
| oracle | mysql_server · 8.0.0 → 8.0.17 |
| oracle | oss_support_tools |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.