CVE-2024-11681

Summary

A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror.

Affected Software

Weaknesses

• CWE-78: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/google/security-research/security/advisories/GHSA-2j38-pjh8-wfxw

• ←Previous
• Next→