CVE-2017-7480

rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution.

Score

CVSS 3.1 9.8 Critical

Status

Modified - secalert@redhat.com

Published

2017-07-21

Last modified

2024-09-16

Weaknesses

CWE-300, CWE-417

Affected products

• Rkhunter (Red Hat Inc.)
• Rootkit Hunter (Rootkit Hunter Project)

References

• http://seclists.org/oss-sec/2017/q2/643
• https://security.gentoo.org/glsa/201805-11