CVE-2019-5443

2019-07-0219:15:10

Google

osv.dev

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

54.7%

JSON

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl “engine”) on invocation. If that curl is invoked by a privileged user it can do anything it wants.

CPENameOperatorVersion
curleqmysql-5.0.83
curleqmysql-8.0.0
curleqcurl-7_13_2
curleqmysql-5.0.19a
curleqmysql-5.6.40
curleqmysql-5.0.36
curleqmysql-cluster-7.1.31
curleqmysql-5.0.46
curleqmysql-5.5.1-m2
curleqmysql-5.6.27

Name	Operator	Version
curl	eq	mysql-5.0.83
curl	eq	mysql-8.0.0
curl	eq	curl-7_13_2
curl	eq	mysql-5.0.19a
curl	eq	mysql-5.6.40
curl	eq	mysql-5.0.36
curl	eq	mysql-cluster-7.1.31
curl	eq	mysql-5.0.46
curl	eq	mysql-5.5.1-m2
curl	eq	mysql-5.6.27