CVE-2019-5443
Summary
| CVE | CVE-2019-5443 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-07-02 19:15:00 UTC |
|---|
| Updated | 2021-11-03 18:21:00 UTC |
|---|
| Description | A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| oss-security - curl: Windows OpenSSL engine code injection |
MLIST |
www.openwall.com |
Mailing List, Patch, Third Party Advisory |
| curl CVE-2019-5443 Local Code Injection Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| October 2019 MySQL Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| Oracle Critical Patch Update Advisory - October 2020 |
MISC |
www.oracle.com |
|
| curl - Windows OpenSSL engine code injection - CVE-2019-5443 |
MISC |
curl.haxx.se |
Patch, Vendor Advisory |
| Oracle Critical Patch Update - October 2019 |
MISC |
www.oracle.com |
|
| Oracle Critical Patch Update Advisory - April 2020 |
N/A |
www.oracle.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
