CVE-2022-39243
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-39243
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39243.json
- Aliases
- Published
- 2022-09-26T14:15:10Z
- Modified
- 2023-11-29T09:49:17.496525Z
- Details
-
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's JavajavalangUNIXProcessforkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
- References
Affected packages
Git / github.com/brettwooldridge/NuProcess
Affected versions
nuprocess-0.*
nuprocess-0.9.0
nuprocess-0.9.1
nuprocess-0.9.2
nuprocess-0.9.3
nuprocess-0.9.4
nuprocess-0.9.5
nuprocess-0.9.6
nuprocess-0.9.7
nuprocess-1.*
nuprocess-1.0.0
nuprocess-1.0.1
nuprocess-1.0.2
nuprocess-1.0.3
nuprocess-1.0.4
nuprocess-1.1.0
nuprocess-1.1.1
nuprocess-1.1.2
nuprocess-1.1.3
nuprocess-1.2.0
nuprocess-1.2.1
nuprocess-1.2.2
nuprocess-1.2.3
nuprocess-1.2.4
nuprocess-1.2.5
nuprocess-1.2.6
nuprocess-2.*
nuprocess-2.0.0
nuprocess-2.0.1
nuprocess-2.0.2
nuprocess-2.0.3
nuprocess-2.0.4