CVE-2023-36812

描述

### Impact OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. ### Patches Patched in [07c4641471c6f5c2ab5aab615969e97211eb50d9](https://github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9) and further refined in https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba ### Workarounds Disable Gunuplot via `tsd.core.enable_ui = true` and remove the shell files https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.bat and https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.sh.

如何修補 CVE-2023-36812

要修補 CVE-2023-36812,請將受影響套件升級到下列已修補版本。

• —升級至 2.4.2 或更新版本

CVE-2023-36812 正在被利用嗎?

中等 — EPSS 為 16.5%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 2.4.2

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-36812
• PATCHgithub.com/OpenTSDB/opentsdb
• WEBpacketstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html
• WEBgithub.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9