webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious website operator or a MitM attacker to take advantage of it for arbitrary code execution, as demonstrated by an "ext::sh -c" attack or an option injection attack.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a     malicious website operator or a MitM attacker to take advantage of it for arbitrary code execution, as     demonstrated by an ext::sh -c attack or an option injection attack. (CVE-2018-7032)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a
    malicious website operator or a MitM attacker to take advantage of it for arbitrary code execution, as
    demonstrated by an "ext::sh -c" attack or an option injection attack. (CVE-2018-7032)

Fixes for CVE-2018-7032 (rhbz#1383312, rhbz#1383313)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
256479	Linux Distros Unpatched Vulnerability : CVE-2018-7032	Nessus	Misc.	high
405684	Alpine: multiple myrepos packages: security update to 1.20180726-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405684	Alpine: multiple myrepos packages: security update to 1.20180726-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
120896	Fedora 28 : myrepos (2018-f17daf1cd6)	Nessus	Fedora Local Security Checks	high
111560	Fedora 27 : myrepos (2018-ee076d0530)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-7032

high

Tenable Plugins

high

high

high

high

high