<!-- This ticket is confidential. --> <!-- ############################# Do not remove the lines above ############################# --> # CVE Reservation Request ## CVE record information **Project name:** Eclipse ioFog **Project id:** iot.iofog **Versions affected:** [1.0.0, 3.7.0], [3.8.0-rc.1, 3.9.1] Versions in [1.0.0, 3.7.0] are affected and are out of support. v3.8 is a greenfield release and those versions will not be patched. Versions in [3.8.0-rc.1, 3.9.1] are affected and will be fixed in a later v3.9 patch. The fixed version is not released yet; this field will be updated when it is. **Common Weakness Enumeration (CWE):** - [CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')](https://cwe.mitre.org/data/definitions/78.html) **Common Attack Pattern Enumerations and Classifications (CAPEC):** - [CAPEC-88: OS Command Injection](https://capec.mitre.org/data/definitions/88.html) **Common Vulnerability Scoring System:** CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS 3.1 equivalent, for reference: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H (7.0 High). The attacker must influence the Controller provisioning-key response (network position against an unverified Controller TLS session, or a Controller the operator deploys against). The operator must then run agent deploy or attach. Impact is command execution on the agent host, not on a listening service. **Summary:** In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. **Links:** - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1066 **Credits:** Eclipse Foundation Security Team