From d84fea93dc1dc1225bc2d86a6fddc6ba1595ce26 Mon Sep 17 00:00:00 2001 From: Sebastian Hildebrandt Date: Sun, 14 Mar 2021 18:17:10 +0100 Subject: [PATCH] updated docs --- docs/security.html | 4 ++-- docs/v4/history.html | 5 +++++ docs/v4/index.html | 4 ++-- docs/v4/security.html | 17 +++++++++++++++++ 4 files changed, 26 insertions(+), 4 deletions(-) diff --git a/docs/security.html b/docs/security.html index 7508f12..aff46fb 100644 --- a/docs/security.html +++ b/docs/security.html @@ -45,7 +45,7 @@

Command Injection Vulnerability

Affected versions: - < 5.6.3 and < 4.34.13
+ < 5.6.3 and < 4.34.16
Date: 2021-03-14
CVE indentifier -

@@ -54,7 +54,7 @@

We had an issue that there was a possibility to perform a potential command injection possibility by passing a manipulated string prototype as a parameter to the following functions. Affected commands: inetLatency(), inetChecksite(), services(), processLoad().

Patch

-

Problem was fixed with additional parameter checking. Please upgrade to version >= 5.6.3 (or >= 4.34.13 if you are using version 4).

+

Problem was fixed with additional parameter checking. Please upgrade to version >= 5.6.3 (or >= 4.34.16 if you are using version 4).

Workarround

If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to inetLatency(), inetChecksite(), services(), processLoad() (string only)

diff --git a/docs/v4/history.html b/docs/v4/history.html index 14962b5..8efd931 100644 --- a/docs/v4/history.html +++ b/docs/v4/history.html @@ -83,6 +83,11 @@ + + 4.34.16 + 2021-03-14 + sanitizeShellString() improvements + 4.34.15 2020-02-23 diff --git a/docs/v4/index.html b/docs/v4/index.html index 4348562..b51e9d8 100644 --- a/docs/v4/index.html +++ b/docs/v4/index.html @@ -165,12 +165,12 @@
- Security advisory:
Update to v4.34.11 + Security advisory:
Update to v4.34.16
systeminformation
 
Version 4 documentation
-
Current Version: 4.34.15
+
Current Version: 4.34.16
diff --git a/docs/v4/security.html b/docs/v4/security.html index 6a41d03..f478020 100644 --- a/docs/v4/security.html +++ b/docs/v4/security.html @@ -42,6 +42,23 @@
Security Advisories
+

Command Injection Vulnerability

+

Affected versions: + < 4.34.13
+ Date: 2021-03-14
+ CVE indentifier - +

+ +

Impact

+

We had an issue that there was a possibility to perform a potential command injection possibility by passing a manipulated string prototype as a parameter to the following functions. Affected commands: inetLatency(), inetChecksite(), services(), processLoad().

+ +

Patch

+

Problem was fixed with additional parameter checking. Please upgrade to version >= 4.34.13 if you are using version 4.

+ +

Workarround

+

If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to inetLatency(), inetChecksite(), services(), processLoad() (string only)

+
+

Insufficient File Scheme Validation

Affected versions: 4.34.12