From 876e9af0d3a643307abeb54702017ddfa6c62a73 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Mon, 26 Aug 2019 22:00:58 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2019/15xxx/CVE-2019-15651.json | 62 ++++++++++++++++++++++++++++++++++ 2019/9xxx/CVE-2019-9193.json | 2 +- 2 files changed, 63 insertions(+), 1 deletion(-) create mode 100644 2019/15xxx/CVE-2019-15651.json diff --git a/2019/15xxx/CVE-2019-15651.json b/2019/15xxx/CVE-2019-15651.json new file mode 100644 index 00000000000..c5fdc2a5b28 --- /dev/null +++ b/2019/15xxx/CVE-2019-15651.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-15651", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is mishandled for a crafted DER certificate in GetLength_ex." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/wolfSSL/wolfssl/issues/2421", + "refsource": "MISC", + "name": "https://github.com/wolfSSL/wolfssl/issues/2421" + } + ] + } +} \ No newline at end of file diff --git a/2019/9xxx/CVE-2019-9193.json b/2019/9xxx/CVE-2019-9193.json index f020ce97452..3639dc2dd3f 100644 --- a/2019/9xxx/CVE-2019-9193.json +++ b/2019/9xxx/CVE-2019-9193.json @@ -34,7 +34,7 @@ "description_data": [ { "lang": "eng", - "value": "** DISPUTED ** In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_read_server_files' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for \u2018COPY TO/FROM PROGRAM\u2019 is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the \u2018COPY FROM PROGRAM\u2019. Furthermore, members in 'pg_read_server_files' can run commands only if either the 'pg_execute_server_program' role or superuser are granted." + "value": "** DISPUTED ** In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for \u2018COPY TO/FROM PROGRAM\u2019 is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the \u2018COPY FROM PROGRAM\u2019." } ] },