CVE-2019-18182: OS Command Injection
pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the downloadwithxfercommand() function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted database and package.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18182?
CVE-2019-18182 is classified as a high severity vulnerability due to its potential for arbitrary command injection.
How do I fix CVE-2019-18182?
To fix CVE-2019-18182, upgrade Pacman to version 5.2 or later, which addresses the vulnerability.
What does CVE-2019-18182 affect?
CVE-2019-18182 affects versions of Pacman before 5.2 and specifically impacts Fedora versions 30 to 32 using unsigned databases.
How can CVE-2019-18182 be exploited?
CVE-2019-18182 can be exploited by an attacker when a user configures a non-default XferCommand and retrieves a maliciously crafted database.
What is the primary issue with CVE-2019-18182?
The primary issue with CVE-2019-18182 is arbitrary command injection in the download_with_xfercommand() function.