| id: GO-2022-1184 | |
| modules: | |
| - module: code.sajari.com/docconv | |
| versions: | |
| - introduced: 1.1.0 | |
| fixed: 1.3.5 | |
| vulnerable_at: 1.3.4 | |
| packages: | |
| - package: code.sajari.com/docconv | |
| symbols: | |
| - PDFHasImage | |
| - ConvertPDF | |
| derived_symbols: | |
| - Convert | |
| - ConvertPages | |
| - ConvertPath | |
| - ConvertPathReadability | |
| summary: OS command injection vulnerability in code.sajari.com/docconv | |
| description: |- | |
| The manipulation of the argument path to docconv.{ConvertPDF,PDFHasImage} leads | |
| to os command injection. | |
| cves: | |
| - CVE-2022-4643 | |
| ghsas: | |
| - GHSA-6m4h-hfpp-x8cx | |
| references: | |
| - fix: https://github.com/sajari/docconv/pull/110 | |
| - web: https://github.com/sajari/docconv/releases/tag/v1.3.5 | |
| - fix: https://github.com/sajari/docconv/commit/b19021ade3d0b71c89d35cb00eb9e589a121faa5 | |
| - web: https://vuldb.com/?id.216502 |