CVE-2014-8990 default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
HighCVSS 7.5
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lsyncd(Debian:12) | < 2.1.5-2 | 2.1.5-2 |
| debian/lsyncd(Debian:13) | < 2.1.5-2 | 2.1.5-2 |
| debian linux | = 7.0 | No fix listed |
| fedoraproject fedora | = 19 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| lsyncd project lsyncd | <= 2.1.5 | No fix listed |
References
- Debian Security Tracker CVE-2014-8990 vendor-advisory
- FEDORA-2014-15393 third-party-advisory vendor-advisory
- FEDORA-2014-15373 third-party-advisory vendor-advisory
- 62321 third-party-advisory
- DSA-3130 third-party-advisory vendor-advisory
- [oss-security] 20141119 CVE request: lsyncd command injection mailing-list third-party-advisory
- [oss-security] 20141120 Re: CVE request: lsyncd command injection exploit mailing-list third-party-advisory
- 71179 third-party-advisory vdb-entry
- github.com exploit issue-tracking patch
- github.com exploit issue-tracking patch
- github.com issue-tracking patch
- GLSA-201702-05 vendor-advisory
- bugs.debian.org issue-tracking