- Security advisory:
Uodate to v4.30.6 + Security advisory:
Update to v4.30.5
systeminformation
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Uodate to v4.30.6 + Security advisory:
Update to v4.30.5
systeminformation
@@ -317,6 +317,7 @@
Issues
+ Security issues: Please have a look at our security advisories
If you run into problems, please check out known issues page first. If you still have problems, please feel free to open an issue on our github page
Upcoming ...
MacOS on ARM, Windows on ARM - we will have a closer look on that! As soon as we have the new hardware here, will work on support for those platforms. We are also planning a new major version Version 5 with some minor breaking changes and some additional features. We will try to make this available Q1 of 2021.
diff --git a/docs/main.js b/docs/main.js
index 96fd76a..cacf037 100644
--- a/docs/main.js
+++ b/docs/main.js
@@ -17,8 +17,9 @@ function createMenu() {
[1, 'vbox', 'Virtual Box'],
[1, 'statsfunctions', 'Observers / Stats'],
[0, '', 'More'],
- [1, 'history', 'Version history'],
+ [1, 'security', 'Security Advisories'],
[1, 'issues', 'Known Issues'],
+ [1, 'history', 'Version history'],
[1, 'copyright', 'Copyright & License'],
[1, 'contributors', 'Contributors'],
[1, 'trademarks', 'Trademarks'],
diff --git a/docs/security.html b/docs/security.html
new file mode 100644
index 0000000..6b0b9f6
--- /dev/null
+++ b/docs/security.html
@@ -0,0 +1,124 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Security Advisories
+
+
+ command injection vulnerability - prototype pollution
+Affected versions:
+ < 4.30.5
+ Date: 2020-11-26
+ CVE indentifier CVE-2020-26245
+
Impact
+Here we had an issue that there was a possibility to inject commands to the command line by property pollution on the string object. Affected commands: inetChecksite().
+ +Patch
+Problem was fixed with a shell string sanitation fix as well as handling prototype polution. Please upgrade to version >= 4.30.5
+ +Workarround
+If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to inetChecksite()
+ + +Command Injection Vulnerability
+Affected versions:
+ < 4.27.11
+ Date: 2020-10-26
+ CVE indentifier CVE-2020-7752
+
Impact
+Here we had an issue that there was a possibility to inject commands to the command line of your machine via systeminformation. Affected commands: inetChecksite().
+ +Patch
+Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.27.11
+ +Workarround
+If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to inetChecksite()
+ +