CVE-2019-10777: OS Command Injection
Published Jan 8, 2020
·Updated
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName".
Affected Software
1 affected component
Amazon Aws Lambda<1.0.5
Event History
Jan 8, 2020
CVE Published
via MITRE·04:13 PM
Data Sourced
via MITRE·04:13 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-10777?
CVE-2019-10777 has a medium severity rating due to the potential for command injection.
2
How do I fix CVE-2019-10777?
To fix CVE-2019-10777, upgrade aws-lambda to version 1.0.5 or higher.
3
What software is affected by CVE-2019-10777?
CVE-2019-10777 affects aws-lambda versions prior to 1.0.5.
4
What types of vulnerabilities does CVE-2019-10777 involve?
CVE-2019-10777 involves command injection vulnerabilities due to unsanitized input.
5
Is CVE-2019-10777 exploitable in production systems?
Yes, CVE-2019-10777 is exploitable if the vulnerable version of aws-lambda is used in production.