Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1ycnA0LTJ4eDMtbXYyOc0n7w

Command injection in gh-ost

Gh-ost version <= 1.1.2 allows users to inject DSN strings via the -database parameter.

This is a low severity vulnerability as the attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server.

Impact

This issue may lead to arbitrary local file read.

Patches

Fixed in 1.1.3+.

Workarounds

None

References

For more information

If you have any questions or comments about this advisory:

Permalink: https://github.com/advisories/GHSA-rrp4-2xx3-mv29
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycnA0LTJ4eDMtbXYyOc0n7w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: about 1 year ago


CVSS Score: 6.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Identifiers: GHSA-rrp4-2xx3-mv29, CVE-2022-21687
References: Repository: https://github.com/github/gh-ost
Blast Radius: 8.2

Affected Packages

go:github.com/github/gh-ost
Dependent packages: 8
Dependent repositories: 16
Downloads:
Affected Version Ranges: < 1.1.3
Fixed in: 1.1.3
All affected versions: 0.7.1, 0.7.2, 0.7.16, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.7, 0.8.8, 0.9.2, 0.9.6, 0.9.7, 0.9.8, 0.9.9, 1.0.1, 1.0.2, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.13, 1.0.14, 1.0.17, 1.0.20, 1.0.21, 1.0.28, 1.0.30, 1.0.32, 1.0.34, 1.0.35, 1.0.36, 1.0.40, 1.0.42, 1.0.44, 1.0.45, 1.0.46, 1.0.47, 1.0.48, 1.0.49, 1.1.0, 1.1.1, 1.1.2
All unaffected versions: 1.1.3, 1.1.4, 1.1.5, 1.1.6