CVE-2014-8517
EPSS 69.1%
Description
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.
How to fix CVE-2014-8517
To remediate CVE-2014-8517, upgrade the affected package to a fixed version below.
- Debian/tnftp—upgrade to 20130505-2 or later
Is CVE-2014-8517 being exploited?
Likely — EPSS is 69.1%, placing CVE-2014-8517 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.
Affected packages (1)
- from 0, < 20130505-2