Upstream information
Description
This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
National Vulnerability Database | |
---|---|
Base Score | 4 |
Vector | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Access Vector | Network |
Access Complexity | Low |
Authentication | Single |
Confidentiality Impact | Partial |
Integrity Impact | None |
Availability Impact | None |
National Vulnerability Database | |
---|---|
Base Score | 6.5 |
Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | Low |
User Interaction | None |
Scope | Unchanged |
Confidentiality Impact | High |
Integrity Impact | None |
Availability Impact | None |
CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- SUSE-SU-2022:2752-1, published Wed Aug 10 16:17:07 UTC 2022
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
openSUSE Leap 15.3 |
| Patchnames: openSUSE-SLE-15.3-2022-2752 |
openSUSE Leap 15.4 |
| Patchnames: openSUSE-SLE-15.4-2022-2752 |
SUSE Timeline for this CVE
CVE page created: Wed Jul 13 18:00:04 2022CVE page last modified: Mon Dec 12 18:36:08 2022