diff --git a/CHANGELOG.md b/CHANGELOG.md index 88cfff7..77d2cb8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,6 +72,7 @@ For major (breaking) changes - **version 4, 3 and 2** - see end of page. | Version | Date | Comment | | -------------- | -------------- | -------- | +| 5.3.1 | 2020-02-14 | `inetLatency()` `ineChecksite()` `servcices()` `processes()` fixed possible security issue | | 5.3.0 | 2020-02-12 | `osInfo()` added remoteSession (windows) | | 5.2.7 | 2020-02-12 | `fsStats()`, `blockDevices()` improved linux | | 5.2.6 | 2020-02-12 | `inetLatency()` fixed possible DOS intrusion | diff --git a/docs/history.html b/docs/history.html index f0e4d75..189f3c2 100644 --- a/docs/history.html +++ b/docs/history.html @@ -56,6 +56,11 @@ + + 5.3.1 + 2020-02-14 + inetLatency() inetChecksite() services() processLoad() fix possible security issue + 5.3.0 2020-02-12 diff --git a/docs/index.html b/docs/index.html index 9e5318e..ab758b6 100644 --- a/docs/index.html +++ b/docs/index.html @@ -166,11 +166,11 @@
- Security advisory:
Update to v5.2.6 + Security advisory:
Update to v5.3.1
systeminformation
 
-
New Version: 5.3.0
+
New Version: 5.3.1
diff --git a/docs/security.html b/docs/security.html index 10ebbcf..316e63f 100644 --- a/docs/security.html +++ b/docs/security.html @@ -43,6 +43,23 @@
Security Advisories
+

Command Injection Vulnerability

+

Affected versions: + < 5.3.1 and < 4.34.11
+ Date: 2021-02-14
+ CVE indentifier - +

+ +

Impact

+

We had an issue that there was a possibility to perform a potential command injection possibility by passing a manipulated array as a parameter to the following functions. Affected commands: inetLatency(), inetChecksite(), services(), processLoad().

+ +

Patch

+

Problem was fixed with additional parameter checking. Please upgrade to version >= 5.3.1 (or >= 4.34.11 if you are using version 4).

+ +

Workarround

+

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to inetLatency(), inetChecksite(), services(), processLoad() (string only)

+
+

DOS Injection Vulnerability

Affected versions: < 5.2.6 and < 4.34.10
diff --git a/docs/v4/history.html b/docs/v4/history.html index 67dcfe3..b3fddef 100644 --- a/docs/v4/history.html +++ b/docs/v4/history.html @@ -83,6 +83,11 @@ + + 4.34.11 + 2020-02-14 + inetLatency() inetChecksite() services() processes() possible security fix + 4.34.10 2020-02-12 diff --git a/docs/v4/index.html b/docs/v4/index.html index fe94b13..79d618e 100644 --- a/docs/v4/index.html +++ b/docs/v4/index.html @@ -165,12 +165,12 @@

- Security advisory:
Update to v4.34.10 + Security advisory:
Update to v4.34.11
systeminformation
 
Version 4 documentation
-
Current Version: 4.34.10
+
Current Version: 4.34.11
diff --git a/docs/v4/security.html b/docs/v4/security.html index 47f66d6..2fcbfdb 100644 --- a/docs/v4/security.html +++ b/docs/v4/security.html @@ -42,6 +42,23 @@
Security Advisories
+

Command Injection Vulnerability

+

Affected versions: + < 4.34.11
+ Date: 2021-02-14
+ CVE indentifier - +

+ +

Impact

+

We had an issue that there was a possibility to perform a potential command injection possibility by passing a manipulated array as a parameter to the following functions. Affected commands: inetLatency(), inetChecksite(), services(), processLoad().

+ +

Patch

+

Problem was fixed with additional parameter checking. Please upgrade to version >= 4.34.11 if you are using version 4.

+ +

Workarround

+

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to inetLatency(), inetChecksite(), services(), processLoad() (string only)

+
+

DOS Injection Vulnerability

Affected versions: < 4.34.10
@@ -57,7 +74,8 @@

Workarround

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to inetLatency() (no spaces)

- +
+

Command Injection Vulnerability

Affected versions: < 4.31.1
@@ -73,9 +91,9 @@

Workarround

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to inetLatency()

- - -

command injection vulnerability - prototype pollution

+
+
+

Command Injection Vulnerability - prototype pollution

Affected versions: < 4.30.5
Date: 2020-11-26
@@ -90,8 +108,8 @@

Workarround

If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to inetChecksite()

- - +
+

Command Injection Vulnerability

Affected versions: < 4.27.11