From 6ae80aa251f9f1a16b46420ce16512d6bfb6f631 Mon Sep 17 00:00:00 2001 From: Sebastian Hildebrandt Date: Sat, 28 Nov 2020 10:40:02 +0100 Subject: [PATCH] updated docs --- docs/index.html | 3 +- docs/main.js | 3 +- docs/security.html | 124 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 128 insertions(+), 2 deletions(-) create mode 100644 docs/security.html diff --git a/docs/index.html b/docs/index.html index ac43620..19f850c 100644 --- a/docs/index.html +++ b/docs/index.html @@ -165,7 +165,7 @@
- Security advisory:
Uodate to v4.30.6 + Security advisory:
Update to v4.30.5
systeminformation
@@ -317,6 +317,7 @@
Issues
+
Security issues: Please have a look at our security advisories
If you run into problems, please check out known issues page first. If you still have problems, please feel free to open an issue on our github page
Upcoming ...
MacOS on ARM, Windows on ARM - we will have a closer look on that! As soon as we have the new hardware here, will work on support for those platforms. We are also planning a new major version Version 5 with some minor breaking changes and some additional features. We will try to make this available Q1 of 2021.

diff --git a/docs/main.js b/docs/main.js index 96fd76a..cacf037 100644 --- a/docs/main.js +++ b/docs/main.js @@ -17,8 +17,9 @@ function createMenu() { [1, 'vbox', 'Virtual Box'], [1, 'statsfunctions', 'Observers / Stats'], [0, '', 'More'], - [1, 'history', 'Version history'], + [1, 'security', 'Security Advisories'], [1, 'issues', 'Known Issues'], + [1, 'history', 'Version history'], [1, 'copyright', 'Copyright & License'], [1, 'contributors', 'Contributors'], [1, 'trademarks', 'Trademarks'], diff --git a/docs/security.html b/docs/security.html new file mode 100644 index 0000000..6b0b9f6 --- /dev/null +++ b/docs/security.html @@ -0,0 +1,124 @@ + + + + + + + + + + + + + + + + + + + + + systeminformation + + + + + + +
+
+ +
+
+
+
Security Advisories
+
+

command injection vulnerability - prototype pollution

+

Affected versions: + < 4.30.5
+ Date: 2020-11-26
+ CVE indentifier CVE-2020-26245 +

+ +

Impact

+

Here we had an issue that there was a possibility to inject commands to the command line by property pollution on the string object. Affected commands: inetChecksite().

+ +

Patch

+

Problem was fixed with a shell string sanitation fix as well as handling prototype polution. Please upgrade to version >= 4.30.5

+ +

Workarround

+

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to inetChecksite()

+ + +

Command Injection Vulnerability

+

Affected versions: + < 4.27.11
+ Date: 2020-10-26
+ CVE indentifier CVE-2020-7752 +

+ +

Impact

+

Here we had an issue that there was a possibility to inject commands to the command line of your machine via systeminformation. Affected commands: inetChecksite().

+ +

Patch

+

Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.27.11

+ +

Workarround

+

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to inetChecksite()

+ +
+
+
+
+
+
+ + + + + + +