critical9.8
CVE-2017-1000215
ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution
Impact
ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xrootd | Xrootd | through 4.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85
- https://github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txt
- https://github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acf
- https://security.gentoo.org/glsa/201903-11
- https://github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85
- https://github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txt
- https://github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acf
- https://security.gentoo.org/glsa/201903-11