CVE-2018-12088
High
Description
S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the filesystem metadata database as up-to-date, temporarily inject zero-valued bytes into files, or temporarily hide parts of files. This is related to the checksum_basic_mapping function.
SeverityHigh
CVSS7.5
Exploit probability—
ProductS3ql
PublishedJun 10, 2018
First seenJun 10, 2018
How to fix
Update
- s3ql_project s3ql2.27 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| s3ql_project s3ql | v < 2.27 | 2.27 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.