CVE-2017-20166 : Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction

Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.

Published 2023-01-10 06:15:10

Updated 2023-01-13 15:42:48

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2017-20166

Ecto Project » Ecto » Version: 2.2.0
cpe:2.3:a:ecto_project:ecto:2.2.0:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 62 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

https://groups.google.com/forum/#!topic/elixir-ecto/0m4NPfg_MMU

Consider removing support for clauses with nil values in `Repo.get_by`
Exploit;Mailing List;Third Party Advisory
https://github.com/elixir-ecto/ecto/commit/db55b0cba6525c24ebddc88ef9ae0c1c00620250

Revert "Add support for clauses with nil values in `Repo.get_by(!)/2`… · elixir-ecto/ecto@db55b0c · GitHub
Patch;Third Party Advisory
https://github.com/elixir-ecto/ecto/pull/2125

Add support for clauses with nil values in `Repo.get_by(!)/2` by tlux · Pull Request #2125 · elixir-ecto/ecto · GitHub
Exploit;Third Party Advisory
https://github.com/advisories/GHSA-2xxx-fhc8-9qvq

Missing `is_nil` requirement · GHSA-2xxx-fhc8-9qvq · GitHub Advisory Database · GitHub
Third Party Advisory

Jump to