CVE-2014-2029 Server-side request forgery in n/a
Man-in-the-middle attackers can execute arbitrary code or read sensitive data via insecure HTTP downloads in Percona Toolkit's version check.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-2029?
CVE-2014-2029 is a high-severity server-side request forgery vulnerability in n/a, published on 28 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com.
Weakness: CWE-200
Which versions are affected by CVE-2014-2029?
It affects 1 product.
Products include Percona Toolkit.
How do I fix CVE-2014-2029?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2014-2029 being exploited?
There is no known exploitation of CVE-2014-2029 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2014-2029, GHSA-8ch9-48h9-cqjf.