Skip to content
OpenAdvisories
Critical · 9.9 CVE-2022-37425 EUVD-2022-40055GHSA-hw6h-8grh-49hp

The FILES directive inside a VM template allows execution of uploaded files when the template is instantiated, resulting in a Remote Code Execution (RCE) attack.

Published Oct 28, 2022 · Updated Aug 3, 2024 · Assigned by blackberry

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inclusion.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS opennebula No fix yet —
Ubuntu 16.04 LTS opennebula No fix yet —

References