CVE-2025-54469 (CNNVD-202510-4245)
中文标题:
NeuVector 操作系统命令注入漏洞
英文标题:
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
漏洞描述
中文描述:
NeuVector是美国NeuVector公司的一套端到端的容器安全平台。该平台包括图像漏洞管理、准入控制和容器进程/文件系统保护等功能。 NeuVector存在操作系统命令注入漏洞，该漏洞源于enforcer容器使用环境变量CLUSTER_RPC_PORT和CLUSTER_LAN_PORT生成通过popen执行的命令时未清理其值，可能导致命令注入攻击。
英文描述:
A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active. The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT are used directly to compose shell commands via popen without validation or sanitization. This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| SUSE | neuvector | - | < 5.3.5 | - |
cpe:2.3:a:suse:neuvector:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-54469 |
2025-11-11 15:23:28 | 2025-11-11 07:40:42 |
| NVD | nvd_CVE-2025-54469 |
2025-11-11 15:01:07 | 2025-11-11 07:48:29 |
| CNNVD | cnnvd_CNNVD-202510-4245 |
2025-11-11 15:13:00 | 2025-11-11 08:00:20 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-202510-4245
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 3 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']