CVE-2019-11627: OS Command Injection
Published Apr 30, 2019
·Updated
gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID.
Affected Software
4 affected components
Signing-party Project Signing-party>=1.1<2.10
Debian Debian Linux=8.0
openSUSE Leap=15.0
openSUSE Leap=42.3
Event History
Apr 30, 2019
CVE Published
via MITRE·10:49 PM
Data Sourced
via MITRE·10:49 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-11627?
CVE-2019-11627 has a high severity due to its potential for shell injection exploitation.
2
How do I fix CVE-2019-11627?
To fix CVE-2019-11627, upgrade signing-party to version 2.10-1 or later.
3
Which versions are affected by CVE-2019-11627?
CVE-2019-11627 affects signing-party versions 1.1.x and 2.x prior to 2.10-1.
4
What is the impact of CVE-2019-11627?
The impact of CVE-2019-11627 includes the potential for remote attackers to execute arbitrary shell commands.
5
Is CVE-2019-11627 present in Debian or openSUSE systems?
Yes, CVE-2019-11627 is present in Debian 8.0 and several openSUSE Leap versions.