What is GHSA-q5pq-pgrv-fh89?

GHSA-q5pq-pgrv-fh89 is a security advisory published by GitHub Security Advisories with Critical severity. dns-sync command injection vulnerability

Which CVE IDs does GHSA-q5pq-pgrv-fh89 cover?

GHSA-q5pq-pgrv-fh89 covers the following CVE IDs: CVE-2014-9682. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-q5pq-pgrv-fh89?

GHSA-q5pq-pgrv-fh89 affects 1 product, including: npm/dns-sync:\u003c 0.1.1.

GHSA-q5pq-pgrv-fh89Critical

dns-sync command injection vulnerability

Vendor

GitHub Security Advisories

Published

October 24, 2017

Last Modified

September 5, 2023

🔗 CVE IDs covered (1)

CVE-2014-9682 →

📋 Description

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

🎯 Affected products1

npm/dns-sync:< 0.1.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2014-9682
https://github.com/skoranga/node-dns-sync/issues/1
https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d
https://github.com/advisories/GHSA-q5pq-pgrv-fh89
http://www.openwall.com/lists/oss-security/2014/11/11/6