CVE-2017-1000215

2017-11-1720:29:00

Google

osv.dev

8.4 High

AI Score

Confidence

High

0.036 Low

EPSS

Percentile

91.7%

JSON

ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution

CPENameOperatorVersion
xrootdeq3.0.3
xrootdeq4.0.0
xrootdeq3.0.1
xrootdeq3.1.0
xrootdeq3.0.0
xrootdeq4.0.0-rc3
xrootdeq3.0.2
xrootdeq3.1.0-rc1
xrootdeq4.0.0-rc2
xrootdeq4.0.0-rc1

Name	Operator	Version
xrootd	eq	3.0.3
xrootd	eq	4.0.0
xrootd	eq	3.0.1
xrootd	eq	3.1.0
xrootd	eq	3.0.0
xrootd	eq	4.0.0-rc3
xrootd	eq	3.0.2
xrootd	eq	3.1.0-rc1
xrootd	eq	4.0.0-rc2
xrootd	eq	4.0.0-rc1

Rows per page:

1-10 of 171

References

github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85

github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txt

github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acf

security.gentoo.org/glsa/201903-11