{"id":"UBUNTU-CVE-2017-15924","details":"In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.","modified":"2025-07-16T07:36:17.849502Z","published":"2017-10-27T16:29:00Z","withdrawn":"2025-07-18T16:44:13Z","upstream":["CVE-2017-15924"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-15924"},{"type":"REPORT","url":"https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/"},{"type":"REPORT","url":"https://github.com/shadowsocks/shadowsocks-libev/issues/1734"},{"type":"REPORT","url":"https://github.com/shadowsocks/shadowsocks-libev/commit/c67d275"},{"type":"REPORT","url":"http://openwall.com/lists/oss-security/2017/10/13/2"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2017-15924"}],"affected":[{"package":{"name":"shadowsocks-libev","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/shadowsocks-libev@3.1.3+ds-1ubuntu2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3+ds-1ubuntu2"}]}],"versions":["3.0.8+ds-2","3.1.0+ds-3","3.1.0+ds-4","3.1.0+ds-5","3.1.1+ds-1","3.1.1+ds-2","3.1.1+ds-3","3.1.3+ds-1ubuntu1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"libshadowsocks-libev-dev","binary_version":"3.1.3+ds-1ubuntu2"},{"binary_name":"libshadowsocks-libev2","binary_version":"3.1.3+ds-1ubuntu2"},{"binary_name":"libshadowsocks-libev2-dbgsym","binary_version":"3.1.3+ds-1ubuntu2"},{"binary_name":"shadowsocks-libev","binary_version":"3.1.3+ds-1ubuntu2"},{"binary_name":"shadowsocks-libev-dbgsym","binary_version":"3.1.3+ds-1ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-15924.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}