OESA-2024-1159

Dashboard / Vulnerabilities / OESA-2024-1159

OESA-2024-1159

Summary: aops-ceres security update

Details: An agent which needs to be adopted in client, it managers some plugins, such as gala-gopher(kpi collection), fluentd(log collection) and so on. Security Fix(es): In versions 1.3.0-1.4.1 of the ceres software package, the execute_shell_command function does not properly verify or filter the command or subcommand parameters entered by users. This allows an attacker to exploit the vulnerability by injecting malicious code and execute arbitrary commands locally. Attackers can exploit this vulnerability to perform unauthorized operations, which may cause severe security threats and losses to the system.(CVE-2021-33633)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1159, https://nvd.nist.gov/vuln/detail/CVE-2021-33633