PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a…

Description

PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a Command ('Command Injection'). The impact is: It is possible to manipulate gpg-keys or execute commands remotely. The component is: function pgp_exec() phkp.php:98. The attack vector is: HKP-Api: /pks/lookup?search.

Scores

EPSS (exploitation in 30 days)

2.5% · top 15% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• Improper Neutralization of Special Elements used in a Command ('Command Injection')
• CWE-78 (opens in a new tab)All about CWE-78 and its CVEs

Affected products

• PHKP · PHKP

  • affected including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b (as of 2018-09-15)

References (1)

• https://github.com/remko/phkp/issues/1 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-1010179](https://trackcve.app/badge/CVE-2019-1010179.svg)](https://trackcve.app/cve/CVE-2019-1010179)

Record last updated 5 Aug 2024, 03:07 UTC.