~ / search / GHSA-g5m7-57ph-j6p8

GHSA-g5m7-57ph-j6p8

OS Command Injection in Nexus Yum Repository Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2019-5475

Packages

EcosystemPackageAffectedFixed in
Maven org.sonatype.nexus.plugins:nexus-yum-repository-plugin < 2.14.14 2.14.14

Details

As written in the advisory (Markdown source, shown as plain text).

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

References

External links from the advisory. They lead to third-party sites.