Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/github/gh-ost

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.8GoPublished

    Command injection in gh-ost

    CVE-2022-21687 · GHSA-rrp4-2xx3-mv29

    Affected
    • Go github.com/github/gh-ost < 1.1.3
    Fixed in
    1.1.3· Vendor fix available
    Issue
    Gh-ost version <= 1.1.2 allows users to inject DSN strings via the -database parameter. This is a low severity vulnerability as the attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. Impact This issue may lead to arbitrary local file read. Patches Fixed in 1.1.3+. Workarounds None References - https://advisory.dw1.io/51 For more information If you have any questions or comments about this advisory: Open an issue in github/gh-ost

    Recommended action: Upgrade to 1.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →