CVE-2018-12088 Other in n/a
An attacker controlling the backend can replay old metadata to temporarily hide or corrupt file contents in S3QL filesystems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-12088?
CVE-2018-12088 is a high-severity vulnerability in n/a, published on 10 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the filesystem metadata database as up-to-date, temporarily inject zero-valued bytes into files, or temporarily hide parts of files. This is related to the checksum_basic_mapping function.
Weakness: CWE-20
Which versions are affected by CVE-2018-12088?
It affects 1 product.
Products include S3ql Project S3ql.
How do I fix CVE-2018-12088?
Upgrade to a fixed version.
Is CVE-2018-12088 being exploited?
There is no known exploitation of CVE-2018-12088 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2018-12088, GHSA-49xr-rr65-3xpc, UBUNTU-CVE-2018-12088.