GitHub Advisoryadvisory · npm

GHSA-552j-pv39-f3jf OS Command injection in ssl-utils

HIGH Published 2022-06-03 Modified 2022-06-03 Official page ↗
Aliases
CVE-2021-34080
Ecosystem
npm
Packages
ssl-utils
Severity
High
Weaknesses
CWE-78
Reviewed
2022-06-03

Affected packages

• npm ssl-utils: <= 1.0.0 (no fix yet)

Description

OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest() and the createCert() functions.

Related

Alias · CVE (1)

  • CVE-2021-34080 OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References