GitHub Advisoryadvisory · Hex
GHSA-2xxx-fhc8-9qvq Ecto missing `is_nil` requirement
CRITICAL
Official page ↗
- Aliases
- CVE-2017-20166
- Ecosystem
- Hex
- Packages
- ecto
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Reviewed
- 2022-04-12
Affected packages
• Hex ecto: >= 2.2.0, < 2.2.1 → fixed in 2.2.1
Description
Ecto will not raise on queries with non-explicit nil comparisons (ie if they aren't checked with `is_nil`).
Related
Alias · CVE (1)
- CVE-2017-20166 Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-20166 advisory
- https://github.com/elixir-ecto/ecto/pull/2125 web
- https://github.com/elixir-ecto/ecto/commit/db55b0cba6525c24ebddc88ef9ae0c1c00620250 web
- https://github.com/elixir-ecto/ecto package
- https://groups.google.com/forum/#!topic/elixir-ecto/0m4NPfg_MMU web