| Package | Affected versions | Patched versions |
|---|---|---|
| net.opentsdb:opentsdb | < 2.4.2 | 2.4.2 |
| opentsdb | < 2.4.2 | 2.4.2 |
OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration.
Patched in 07c4641471c6f5c2ab5aab615969e97211eb50d9 and further refined in https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba
Disable Gunuplot via tsd.core.enable_ui = true and remove the shell files https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.bat and https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.sh.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free