GHSA-m2mx-rfpw-jghv

Source

https://github.com/advisories/GHSA-m2mx-rfpw-jghv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-m2mx-rfpw-jghv/GHSA-m2mx-rfpw-jghv.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-m2mx-rfpw-jghv

Aliases

CVE-2020-13110

Published

2020-09-04T18:01:59Z

Modified

2023-11-01T04:51:39.145344Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

DLL Injection in kerberos

Details

Version of kerberos prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine.

Recommendation

Upgrade to version 1.0.0 or later.

Database specific

{
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-427"
    ],
    "nvd_published_at": null,
    "github_reviewed_at": "2020-08-31T19:01:58Z",
    "github_reviewed": true
}

References

Affected packages

npm / kerberos

Package

Name: kerberos; View open source insights on deps.dev
Purl: pkg:npm/kerberos

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-m2mx-rfpw-jghv/GHSA-m2mx-rfpw-jghv.json"