Threats tagged 'ghsa-w6f9-5453-8p69'

Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1 contain a vulnerability where the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands executed on remote agent hosts. An attacker able to modify the API response can inject shell metacharacters, causing arbitrary command execution on the agent host when the operator deploys or attaches an agent. This issue is fixed in version 3.9.2.