CVE-2017-15924
Fixed in a distro release EPSS 1%
In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.
Products: shadowsocks-libev, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | shadowsocks-libev | 3.1.0+ds-2 |
| Debian 13 | shadowsocks-libev | 3.1.0+ds-2 |
| Debian 9 | shadowsocks-libev | 2.6.3+ds-3+deb9u1 |
| openSUSE Tumbleweed | shadowsocks-libev | 3.3.5-1.9 |