CVE-2019-1010306 Slanger Arbitrary command execution
A remote unauthenticated attacker can execute arbitrary commands on Slanger servers via crafted requests due to unsafe deserialization in the message handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-1010306?
CVE-2019-1010306 is a critical unsafe deserialization vulnerability in Slanger, published on 15 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.
Weakness: CWE-502
Which versions are affected by CVE-2019-1010306?
2 open source packages ship an affected version, including slanger. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
slanger RubyGems | All versions | 0.6.1 |
slanger RubyGems | All versions | 0.6.1 |
Products include Teller Slanger.
How do I fix CVE-2019-1010306?
Upgrade slanger to 0.6.1 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-1010306 being exploited?
There is no known exploitation of CVE-2019-1010306 in the wild and no public exploit code.
Sources
Also known as GHSA-rg32-m3hf-772v.