4 ms·
I recently checked the changelog of rundesk. One possible reason for upgrading was a CVE scored 'high'. This one: https://nvd.nist.gov/vuln/detail/CVE-2022-4
by hyperman1 3y ago
I recently checked the changelog of rundesk. One possible reason for upgrading was a CVE scored 'high'. This one:
https://nvd.nist.gov/vuln/detail/CVE-2022-45868 https://nvd.nist.gov/vuln/detail/CVE-2022-45868
Total waste of everybody's time. You have to start h2 as server, instead of as dependency. You then have to start it with a command line parameter with a password, instead of specifying it in a config file. Both actions scream debug-configuration. If you do this, then... the password is readable on the command line.
That's the whole vulnerability. Analogy: if you leave a key on the table, people inside the same house can take it, and that's a vulnerability for the door.
So now h2 is 'vulnerable', every application needs to upgrade the dependency, and everybody needs to upgrade the application. What a total waste of time.
- bombcar 3y agoTo be fair, it is possible for a command to obfuscate it's own command line (I've seen this in `ps auwx` but can't offhand recall which command was doing it). But in no way is that high - CVE ratings have turned to useless junk quite rapidly, probably sometime around when it became monetizable.
- deleted 3y ago[deleted]
- stebalien 3y agoObfuscating your commandline is racy. The only fix for issues like this is to not pass passwords on the commandline, except when debugging.
- happymellon 3y agoYeah, having to deal with the level 10 CVE for Postgres from Tuesday. https://nvd.nist.gov/vuln/detail/CVE-2024-1597 https://nvd.nist.gov/vuln/detail/CVE-2024-1597 Postgres drivers are now all highly vulnerable and blocked in our pipelines because of overeager security, level 10 means that we can't get waivers for it either. But you can't exploit because no one uses PreferQueryMode=SIMPLE.