OESA-2024-1159

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1159

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2024-1159.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2024-1159

Upstream

CVE-2021-33633

Published

2024-02-08T11:06:36Z

Modified

2026-08-18T01:18:15Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

aops-ceres security update

Details

An agent which needs to be adopted in client, it managers some plugins, such as gala-gopher(kpi collection), fluentd(log collection) and so on.

Security Fix(es): In versions 1.3.0-1.4.1 of the ceres software package, the execute_shell_command function does not properly verify or filter the command or subcommand parameters entered by users. This allows an attacker to exploit the vulnerability by injecting malicious code and execute arbitrary commands locally. Attackers can exploit this vulnerability to perform unauthorized operations, which may cause severe security threats and losses to the system.(CVE-2021-33633)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:20.03-LTS-SP4 / aops-ceres

Package

Name: aops-ceres
Purl: pkg:rpm/openEuler/aops-ceres&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

v1.3.4-14.oe2003sp4

Ecosystem specific

{
    "aarch64": [
        "da-tool-v1.3.4-14.oe2003sp4.aarch64.rpm",
        "dnf-hotpatch-plugin-v1.3.4-14.oe2003sp4.aarch64.rpm",
        "aops-ceres-v1.3.4-14.oe2003sp4.aarch64.rpm"
    ],
    "src": [
        "aops-ceres-v1.3.4-14.oe2003sp4.src.rpm"
    ],
    "x86_64": [
        "da-tool-v1.3.4-14.oe2003sp4.x86_64.rpm",
        "dnf-hotpatch-plugin-v1.3.4-14.oe2003sp4.x86_64.rpm",
        "aops-ceres-v1.3.4-14.oe2003sp4.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2024-1159.json"

openEuler:22.03-LTS-SP3 / aops-ceres

Package

Name: aops-ceres
Purl: pkg:rpm/openEuler/aops-ceres&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

v1.4.1-6.oe2203sp3

Ecosystem specific

{
    "aarch64": [
        "aops-ceres-v1.4.1-6.oe2203sp3.aarch64.rpm",
        "da-tool-v1.4.1-6.oe2203sp3.aarch64.rpm",
        "dnf-hotpatch-plugin-v1.4.1-6.oe2203sp3.aarch64.rpm"
    ],
    "src": [
        "aops-ceres-v1.4.1-6.oe2203sp3.src.rpm"
    ],
    "x86_64": [
        "aops-ceres-v1.4.1-6.oe2203sp3.x86_64.rpm",
        "da-tool-v1.4.1-6.oe2203sp3.x86_64.rpm",
        "dnf-hotpatch-plugin-v1.4.1-6.oe2203sp3.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2024-1159.json"