Published: 02/07/2019 Updated: 03/11/2021

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 392

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl
oracle http server 12.2.1.3.0
oracle enterprise manager ops center 12.3.3
oracle enterprise manager ops center 12.4.0
oracle oss support tools 20.0
oracle http server 12.2.1.4.0
oracle mysql server
netapp snapcenter -
netapp oncommand unified manager
netapp oncommand workflow automation -
netapp oncommand insight -

When the database server or libpq client library initializes SSL, libeay32dll attempts to read configuration from a hard-coded directory Typically, the directory does not exist, but any local user could create it and inject configuration This configuration can direct OpenSSL to load and execute arbitrary code as the user running a PostgreSQL s ...

Critical Infrastructure Sectors: Critical Manufacturing

Windows OpenSSL engine code injection ===================================== Project curl Security Advisory, June 24th 2019 - [Permalink](curlhaxxse/docs/CVE-2019-5443html) VULNERABILITY ------------- A non-privileged user or program can put code and a config file in a known non-privileged path (under `C:/usr/local/`) that will make cu ...

Automated, reproducible, transparent, Windows builds for curl, nghttp2, brotli, libssh2 and OpenSSL 11 SECURITY NOTICE: It is strongly recommended to upgrade to curl 7651_2 and OpenSSL 111c_2, released on 2019-06-20, or newer Previous releases were discovered to have a code injection (and potential privilege escalation) vulnerability triggered via OpenSSL's build co

CWE-427 http://www.openwall.com/lists/oss-security/2019/06/24/1 https://curl.haxx.se/docs/CVE-2019-5443.html http://www.securityfocus.com/bid/108881 https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html https://security.netapp.com/advisory/ntap-20191017-0002/https://www.oracle.com/security-alerts/cpuapr2020.html https://www.oracle.com/security-alerts/cpuoct2020.html https://nvd.nist.gov https://github.com/EmilioBerlanda/cURL https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10 https://www.postgresql.org/support/security/CVE-2019-10211/

CVE-2019-5443

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect