{"containers": {"cna": {"affected": [{"product": "awesome_spawn", "vendor": "n/a", "versions": [{"status": "affected", "version": ">1.20, >= 1.30"}]}], "descriptions": [{"lang": "en", "value": "Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-30T20:36:09", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://rubysec.com/advisories/CVE-2014-0156/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-0156", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "awesome_spawn", "version": {"version_data": [{"version_value": ">1.20, >= 1.30"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-78"}]}]}, "references": {"reference_data": [{"name": "https://rubysec.com/advisories/CVE-2014-0156/", "refsource": "MISC", "url": "https://rubysec.com/advisories/CVE-2014-0156/"}, {"name": "https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff", "refsource": "MISC", "url": "https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:05:38.811Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://rubysec.com/advisories/CVE-2014-0156/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2014-0156", "datePublished": "2022-06-30T20:36:09", "dateReserved": "2013-12-03T00:00:00", "dateUpdated": "2024-08-06T09:05:38.811Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:manageiq:awesomespawn:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA72EF0C-A701-40BB-910B-9CC4C82E2D28", "versionEndExcluding": "1.5.0", "versionStartIncluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command."}, {"lang": "es", "value": "Awesome spawn contiene una vulnerabilidad de inyecci\u00f3n de comandos en el Sistema Operativo, que permite una ejecuci\u00f3n de comandos adicionales pasados a Awesome spawn como argumentos. Si es incluida una entrada no confiable en los argumentos de los comandos, el atacante pod\u00eda usar este fallo para ejecutar un comando arbitrario"}], "id": "CVE-2014-0156", "lastModified": "2022-07-12T15:31:59.640", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-30T21:15:10.373", "references": [{"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://rubysec.com/advisories/CVE-2014-0156/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "awesome_spawn: OS command injection vulnerability", "id": "2102827", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2102827"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command."], "name": "CVE-2014-0156", "package_state": [{"cpe": "cpe:/a:redhat:cloudforms_managementengine:5", "fix_state": "Not affected", "package_name": "cfme-gemset", "product_name": "CloudForms Management Engine 5"}], "public_date": "2014-03-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-0156\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-0156\nhttps://rubysec.com/advisories/CVE-2014-0156/"], "threat_severity": "Moderate", "upstream_fix": "awesome_spawn 1.20, awesome_spawn 1.3.0"}