An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade busybox | Mar 26, 2024 | Nov 15, 2021 |
| Debian | — | Upgrade busybox | Jul 30, 2024 | Nov 15, 2021 |
| Gentoo Linux | — | Upgrade sys-apps/busybox. | Jul 9, 2024 | Nov 15, 2021 |
| Suse | — | Upgrade busybox-testsuiteUpgrade busybox-staticUpgrade busybox-warewulf3Upgrade busybox | Jan 21, 2022 | Nov 15, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub