Vulnerability · Published Mar 1, 2024 · Assigned by cisco
CVE-2024-20328ClamAV VirusEvent File Processing Command Injection Vulnerability
Medium 5.3
In plain English
A medium-severity OS command injection in ClamAV from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 84.8% (higher than 99.7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | clamav | 1.2.2-r0 | ALPINE-CVE-2024-20328 |
| Alpine:v3.21 | clamav | 1.2.2-r0 | ALPINE-CVE-2024-20328 |
| Alpine:v3.22 | clamav | 1.2.2-r0 | ALPINE-CVE-2024-20328 |
| Alpine:v3.23 | clamav | 1.2.2-r0 | ALPINE-CVE-2024-20328 |
| Alpine:v3.24 | clamav | 1.2.2-r0 | ALPINE-CVE-2024-20328 |
| Debian:12 | clamav | 1.0.5+dfsg-1~deb12u1 | DEBIAN-CVE-2024-20328 |
| Debian:13 | clamav | 1.0.5+dfsg-1 | DEBIAN-CVE-2024-20328 |
| Debian:14 | clamav | 1.0.5+dfsg-1 | DEBIAN-CVE-2024-20328 |
| Ubuntu:24.04:LTS | clamav | 1.0.5+dfsg-1ubuntu1 | UBUNTU-CVE-2024-20328 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L