GitHub Advisoryadvisory · Hex
GHSA-w98m-2xqg-9cvj Remote Code Execution in paginator
CRITICAL
Official page ↗
- Aliases
- CVE-2020-15150
- Ecosystem
- Hex
- Packages
- paginator
- Severity
- Critical
- Reviewed
- 2022-04-12
Affected packages
• Hex paginator: < 1.0.0 → fixed in 1.0.0
Description
There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function.
Impact
There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. This will potentially affect all current users of `Paginator` prior to version >= 1.0.0.
Patches
The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.
Credits
Thank you to Peter Stöckli.
Related
Alias · CVE (1)
- CVE-2020-15150 There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input… vulnerability
References
- https://github.com/duffelhq/paginator/security/advisories/GHSA-w98m-2xqg-9cvj web
- https://nvd.nist.gov/vuln/detail/CVE-2020-15150 advisory
- https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8 web
- https://github.com/duffelhq/paginator package
- https://github.com/duffelhq/paginator/blob/ccf0f37fa96347cc8c8a7e9eb2c64462cec4b2dc/README.md#security-considerations web
- https://hex.pm/packages/paginator web