CVE-2019-11627: debian debian_linux

Modified

AliasesMGASA-2019-0386UBUNTU-CVE-2019-11627DEBIAN-CVE-2019-11627+2 more

Published 30-04-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-11627 is a high (CVSS 10.0) vulnerability in debian debian_linux. EPSS estimates a 2.74% chance of exploitation in the next 30 days, higher than 86.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

2.74%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:11383-1

Timeline

30-04-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.19.8v2.010.0

EPSS trend

Probability

2.74%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.74% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.debian.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Debian2 products

signing-party< 2.10-1 | < 1.1.10-3+deb8u1
debian_linuxEOL8.0

Opensuse2 products

leapEOL15.0 | 42.3
signing-party&distro=openSUSE Leap 15.0< 2.7-lp150.5.1

Mageia1 product

signing-party< 2.10-1.mga7

Signing-party_project1 product

signing-party≥ 1.1, < 2.10

Ubuntu1 product

signing-partyAll versions (No fix recorded)

5 vendors · 7 products

References

12 links

bugs.debian.org/928256X Refsource MISCExploitIssue TrackingMailing ListThird Party AdvisoryREPORT
lists.debian.org/debian-lts-announce/2019/05/msg00001.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-05/msg00029.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
advisories.mageia.org/MGASA-2019-0386.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=25742REPORT
lists.opensuse.org/opensuse-updates/2019-05/msg00085.htmlWEB
ubuntu.com/security/CVE-2019-11627REPORT
www.cve.org/CVERecord?id=CVE-2019-11627REPORT
security-tracker.debian.org/tracker/CVE-2019-11627Advisory
lists.opensuse.org/archives/…Advisory

Show all 12 references