CVE-2014-8990

Lsyncd <2.1.5 - Command Injection

Title source: llm
STIX 2.1

Description

default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

References (11)

Core 11
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62321
Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145131.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/11/19/1
Issue Tracking, Patch x_refsource_confirm
https://github.com/axkibe/lsyncd/issues/220
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/71179
Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145114.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2015/dsa-3130
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/11/20/5
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201702-05

Scores

EPSS 0.0524
EPSS Percentile 91.5%

Details

CWE
CWE-77
Status published
Products (4)
debian/debian_linux 7.0
fedoraproject/fedora 19
fedoraproject/fedora 20
lsyncd_project/lsyncd < 2.1.5
Published Dec 05, 2014
Tracked Since Feb 18, 2026