mike/systeminformation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sanitizeShellString() and other security improvements

Browse Source
This commit is contained in:
Sebastian Hildebrandt
2021-03-15 11:21:32 +01:00
parent b106e41538
commit 7922366d70
11 changed files with 95 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security.html
+3 -3
View File
@@ -45,8 +45,8 @@
<div class="text">
<h2>Command Injection Vulnerability</h2>
<p><span class="bold">Affected versions:</span>
&lt; 5.6.3 and &lt; 4.34.16<br>
<span class="bold">Date:</span> 2021-03-14<br>
&lt; 5.6.4 and &lt; 4.34.17<br>
<span class="bold">Date:</span> 2021-03-15<br>
<span class="bold">CVE indentifier</span> -
</p>
@@ -54,7 +54,7 @@
<p>We had an issue that there was a possibility to perform a potential command injection possibility by passing a manipulated string prototype as a parameter to the following functions. Affected commands: <span class="code">inetLatency()</span>, <span class="code">inetChecksite()</span>, <span class="code">services()</span>, <span class="code">processLoad()</span>.</p>
<h4>Patch</h4>
<p>Problem was fixed with additional parameter checking. Please upgrade to version >= 5.6.3 (or >= 4.34.16 if you are using version 4).</p>
<p>Problem was fixed with additional parameter checking. Please upgrade to version >= 5.6.4 (or >= 4.34.17 if you are using version 4).</p>
<h4>Workarround</h4>
<p>If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to <span class="code">inetLatency()</span>, <span class="code">inetChecksite()</span>, <span class="code">services()</span>, <span class="code">processLoad()</span> (string only)</p>