CVE-2019-0542 xterm vulnerable to remote code execution
Attackers can execute arbitrary code remotely by exploiting improper handling of special characters in the xterm.js terminal library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-0542?
CVE-2019-0542 is a high-severity code injection vulnerability in Redhat Openshift Container Platform, published on 9 Jan 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.
Weakness: CWE-94
Which versions are affected by CVE-2019-0542?
6 open source packages ship an affected version, including xterm. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
xterm npm | All versions | 3.8.1 |
xterm npm | All versions | 3.8.1 |
xterm npm | From 3.10.0 | 3.10.1 |
xterm npm | From 3.10.0 | 3.10.1 |
xterm npm | From 3.9.0 | 3.9.2 |
xterm npm | From 3.9.0 | 3.9.2 |
Linux distribution packages (3)
atomic-openshift-web-console Red Hat:openshift:3.10::el7 | All versions | 0:3.10.163-1.git.1.c3a2131.el7 |
atomic-openshift-web-console Red Hat:openshift:3.11::el7 | All versions | 0:3.11.104-1.git.1.3c3a7f2.el7 |
atomic-openshift-web-console Red Hat:openshift:3.9::el7 | All versions | 0:3.9.99-1.git.1.49cd7e9.el7 |
Products include Redhat Openshift Container Platform, Xtermjs Xterm.js.
How do I fix CVE-2019-0542?
Upgrade xterm to a fixed version for your release line: 3.8.1, 3.10.1 or 3.9.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-0542 being exploited?
There is no known exploitation of CVE-2019-0542 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openshift Container Platform
- CVE-2020-27836 Missing authorization in cluster-ingress-operator
- CVE-2018-1085 Misconfiguration in openshift-ansible
- CVE-2026-54099 Privilege escalation in Red Hat OpenShift Container Platform 4
- CVE-2026-1784 Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection
- CVE-2021-20182 Privilege escalation in openshift
Sources
Also known as DEBIAN-CVE-2019-0542, GHSA-mc23-976p-j42x, RHSA-2019:1422, RHSA-2019:2551, RHSA-2019:2552.