inetChecksite() possible security issue fix
This commit is contained in:
@@ -67,7 +67,7 @@
|
||||
<p>This library is supposed to be used as a <a href="https://nodejs.org/en/" rel="nofollow">node.js</a> backend/server-side library and will definilely not work within a browser.</p>
|
||||
|
||||
<h2>Installation (old version 4)</h2>
|
||||
<pre>$ npm install systeminformation@4 —save</pre>
|
||||
<pre>$ npm install systeminformation@4 —-save</pre>
|
||||
<h2>Usage</h2>
|
||||
<p>All functions (except <span class="code">version</span> and <span class="code">time</span>) are implemented as asynchronous functions. Here a small example how to use them:</p>
|
||||
<pre><code class="js">const si = require('systeminformation');
|
||||
|
||||
@@ -83,6 +83,11 @@
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<th scope="row">4.34.12</th>
|
||||
<td>2020-02-15</td>
|
||||
<td><span class="code">inetLatency()</span> <span class="code">inetChecksite()</span> fix possible security issue (file://)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th scope="row">4.34.11</th>
|
||||
<td>2020-02-14</td>
|
||||
|
||||
+1
-1
@@ -170,7 +170,7 @@
|
||||
<div class="title">systeminformation </div>
|
||||
<div class="subtitle"><span id="typed"></span> </div>
|
||||
<div class="version larger">Version 4 documentation</div>
|
||||
<div class="version">Current Version: <span id="version">4.34.11</span></div>
|
||||
<div class="version">Current Version: <span id="version">4.34.12</span></div>
|
||||
<button class="btn btn-light" onclick="location.href='https://github.com/sebhildebrandt/systeminformation'">View on Github <i class=" fab fa-github"></i></button>
|
||||
</div>
|
||||
<div class="down">
|
||||
|
||||
@@ -42,6 +42,23 @@
|
||||
<div class="col-12 sectionheader">
|
||||
<div class="title">Security Advisories</div>
|
||||
<div class="text">
|
||||
<h2>Insufficient File Scheme Validation</h2>
|
||||
<p><span class="bold">Affected versions:</span>
|
||||
4.34.12<br>
|
||||
<span class="bold">Date:</span> 2021-02-15<br>
|
||||
<span class="bold">CVE indentifier</span> -
|
||||
</p>
|
||||
|
||||
<h4>Impact</h4>
|
||||
<p>We had an issue that there was a possibility to run inetChecksite against local files due to improper file scheme validation. Affected commands: <span class="code">inetLatency()</span>, <span class="code">inetChecksite()</span>.</p>
|
||||
|
||||
<h4>Patch</h4>
|
||||
<p>Problem was fixed with additional parameter checking. Please upgrade to version >= 4.34.12 if you are using version 4.</p>
|
||||
|
||||
<h4>Workarround</h4>
|
||||
<p>If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to <span class="code">inetLatency()</span>, <span class="code">inetChecksite()</span> (sanitize `file://` parameter)</p>
|
||||
<hr>
|
||||
<br>
|
||||
<h2>Command Injection Vulnerability</h2>
|
||||
<p><span class="bold">Affected versions:</span>
|
||||
< 4.34.11<br>
|
||||
|
||||
Reference in New Issue
Block a user