CVE-2017-7239 Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan results, or cause a denial of service (process hang) via a crafted filename.
CriticalCVSS 9.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan results, or cause a denial of service (process hang) via a crafted filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ninka project ninka | <= 1.3.0 | No fix listed |
References
- [oss-security] 20170403 CVE-2017-7239: ninka license identification tool: insufficient escaping of external input [vs] mailing-list third-party-advisory
- 97325 third-party-advisory vdb-entry
- github.com patch third-party-advisory