NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where     it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers     can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't     vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability     can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a     workaround, users of the library can sanitize command strings to remove NUL characters prior to passing     them to NuProcess for execution. (CVE-2022-39243)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where
    it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers
    can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't
    vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability
    can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a
    workaround, users of the library can sanitize command strings to remove NUL characters prior to passing
    them to NuProcess for execution. (CVE-2022-39243)

ID	Name	Product	Family	Severity
262410	Linux Distros Unpatched Vulnerability : CVE-2022-39243	Nessus	Misc.	critical
414174	SCA: security update for com.zaxxer:nuprocess (GHSA-cxgf-v2p8-7ph7)	Tenable Cloud Security	SCA Checks	critical
414174	SCA: security update for com.zaxxer:nuprocess (GHSA-cxgf-v2p8-7ph7)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2022-39243

critical

Tenable Plugins

critical

critical

critical