High · published July 2, 2019
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
| Product | Versions | Fixed in |
|---|---|---|
| haxx/curl | ≤ 7.65.1 | — |
| oracle/enterprise_manager_ops_center | all versions | — |
| oracle/enterprise_manager_ops_center | all versions | — |
| oracle/http_server | all versions | — |
| oracle/http_server | all versions | — |
| oracle/mysql_server | ≥ 5.0.0, ≤ 5.7.27 | — |
| oracle/mysql_server | ≥ 8.0.0, ≤ 8.0.17 | — |
| oracle/oss_support_tools | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_unified_manager | ≥ 7.3 | — |
| netapp/oncommand_unified_manager | ≥ 9.5 | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/snapcenter | all versions | — |