Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2019-3462 - DOCKER:chartmuseumui-0.0.7 #44

Open
RajuMedpur opened this issue Mar 4, 2021 · 0 comments
Open

CVE-2019-3462 - DOCKER:chartmuseumui-0.0.7 #44

RajuMedpur opened this issue Mar 4, 2021 · 0 comments

Comments

@RajuMedpur
Copy link

RajuMedpur commented Mar 4, 2021

This is related to CVE issue 2019-3462 which says below
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.

Max Justicz discovered a vulnerability in APT, the high level package manager. The code handling HTTP redirects in the HTTP transport method doesn't properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine.

Since the vulnerability is present in the package manager itself. This looks to be generic for all open sources .

Is this fixed to latest Docker: chartmuseumui ? Pls share if any updates

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant