title: Remote Code Execution
description: External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py.
This issue affects Yugabyte DB: Lesser then 2.2.0.0
problem types: CWE-642: External Control of Critical State Data
affected:
{
defaultStatus: unaffected
modules: [DevopsBase.java:execCommand, TableManager.java:runCommand]
platforms: [Linux, Docker, Kubernetes, MacOS]
product: YugabyteDB
vendor: YugabyteDB
versions:
lessThan: 2.15, status: affected, version: 2.0, versionType: 2.0 to 2.14
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Use Yugabyte version 2.3.3.0-b106 or higher.
workarounds: In yugaware/config/configs folder there is a file acceptableKeys.yaml which contains a list of acceptable keys for different types of providers. Edit it and restart the Yugaware process to reload the list.