Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
Résumé
Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov