CVE-2019-12928: Command Injection
DISPUTED The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12928?
CVE-2019-12928 has a moderate severity rating due to the potential for OS command injection and code execution.
How do I fix CVE-2019-12928?
To mitigate CVE-2019-12928, upgrade to QEMU version 4.1.0 or later where the vulnerability has been addressed.
Who is affected by CVE-2019-12928?
Users and systems running QEMU version 4.0.0 or earlier are affected by CVE-2019-12928.
What type of attacks can exploit CVE-2019-12928?
CVE-2019-12928 can be exploited for remote code execution, denial of service, and information disclosure.
Is CVE-2019-12928 a local or remote vulnerability?
CVE-2019-12928 is a remote vulnerability since it allows attackers to initiate commands over a network.