CVE-2024-20328
CVE-2024-20328 · ClamAV VirusEvent File Processing Command Injection Vulnerability
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS 5.3 · Moyenne · EPSS 84,8% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
clamav
- Versions du logiciel
- 1.2.0: Concernée
- 1.2.1: Concernée
Aucun correctif publié
clamav Debian:12
- Versions du logiciel
- 1.0.1+dfsg-2
- 1.0.2+dfsg-1
- 1.0.2+dfsg-1~deb12u1
- 1.0.3+dfsg-1
- 1.0.3+dfsg-1~deb12u1
- 1.0.3+dfsg-2
- 1.0.4+dfsg-1
- Plages de versions concernées
- ECOSYSTEM: < 1.0.5+dfsg-1~deb12u1
Mettez à jour vers 1.0.5+dfsg-1~deb12u1
clamav Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 1.0.5+dfsg-1
Mettez à jour vers 1.0.5+dfsg-1
clamav Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 1.0.5+dfsg-1
Mettez à jour vers 1.0.5+dfsg-1
clamav Ubuntu:24.04:LTS
- Versions du logiciel
- 1.0.2+dfsg-1ubuntu1
- 1.0.3+dfsg-2ubuntu1
- 1.0.4+dfsg-0ubuntu1
- Plages de versions concernées
- ECOSYSTEM: < 1.0.5+dfsg-1ubuntu1
Mettez à jour vers 1.0.5+dfsg-1ubuntu1