UpHeron
All vulnerabilities

Servers and applications

CVE-2019-5443

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.

Severity
High 7.8
Published
2 Jul 2019
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • Every version up to 7.65.1
MySQLServers and applications · cpe:a:oracle:mysql_server
  • From 5.0.0 up to 5.7.27
  • From 8.0.0 up to 8.0.17

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-5443
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-5443