ASA-201711-40 generated external raw

[ASA-201711-40] shadowsocks-libev: arbitrary command execution
Arch Linux Security Advisory ASA-201711-40 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-15924 Package : shadowsocks-libev Type : arbitrary command execution Remote : No Link : Summary ======= The package shadowsocks-libev before version 3.1.1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.1.1-1. # pacman -Syu "shadowsocks-libev>=3.1.1-1" The problem has been fixed upstream in version 3.1.1. Workaround ========== None. Description =========== In manager.c in ss-manager in shadowsocks-libev before 3.1.1, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via UDP traffic, related to the add_server, build_config, and construct_command_line functions. Impact ====== A local attacker could send a specially crafted configuration request to localhost that, when processed by ss-manager, leads to the execution of arbitrary commands as the user running ss-manager. References ==========