GitHub Advisoryadvisory · npm

GHSA-w5m8-5v9m-xhx5 Critical severity vulnerability that affects Haraka

CRITICAL Published 2019-02-12 Modified 2021-09-21 Official page ↗
Aliases
CVE-2016-1000282
Ecosystem
npm
Packages
Haraka
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2020-06-16

Affected packages

• npm Haraka: < 2.8.9 → fixed in 2.8.9

Description

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.

Related

Alias · CVE (1)

  • CVE-2016-1000282 Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References