| Package | Affected versions | Patched versions |
|---|---|---|
| curl | ≤ 7.65.1 | |
| oncommand unified manager | ≥ 7.3≥ 9.5 | |
| enterprise manager ops center | = 12.3.3= 12.4.0 | |
| http server | = 12.2.1.3.0= 12.2.1.4.0 | |
| mysql server | ≥ 5.0.0, ≤ 5.7.27≥ 8.0.0, ≤ 8.0.17 | |
| oss support tools | = 20.0 |
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free