ROSA LABROSA-SA-2023-2096Advisory ROSA-SA-2023-2096
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
47.2%
Software: libXpm 3.5.12
OS: rosa-server79
package_evr_string: libXpm-3.5.12-1
CVE-ID: CVE-2022-4883
BDU-ID: 2023-00388
CVE-Crit: HIGH
CVE-DESC: When processing files with .Z or .gz extensions, the library calls external programs to compress and decompress the files, relying on the PATH environment variable to find these programs, which could allow an attacker to execute other programs by manipulating the PATH environment variable.
CVE-STATUS: Fixed
CVE-REV: To close, run the yum update command
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
47.2%