redhat enterprise-virtualization CVE-2018-1111 in Red Hat and Fedora Project Products
Published on May 17, 2018

product logo product logo
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Weakness Type

What is a Command Injection Vulnerability?

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CVE-2018-1111 has been classified to as a Command Injection vulnerability or weakness.


Products Associated with CVE-2018-1111

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-1111 are published in these products:

Red Hat Enterprise Virtualization
 
Red Hat Enterprise Virtualization Host
 
Fedora Project Fedora
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Enterprise Linux Desktop
 
Red Hat Enterprise Linux Server
 
Red Hat Enterprise Linux Workstation
 

Affected Versions

Red Hat dhcp: Fedora dhcp:

Exploit Probability

EPSS
89.18%
Percentile
99.52%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.