Linuxfoundation Osquery vulnerabilities

5 CVEs affecting Linuxfoundation Osquery, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-26273, published 2020-12-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3567, published 2019-06-03. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe'…
CVE-2020-1887, published 2020-03-13. Critical severity, CVSS 9.1. EPSS: 1.6% chance of exploitation in the next 30 days. Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.
CVE-2020-26273, published 2020-12-16. Medium severity, CVSS 5.2. EPSS: 1% chance of exploitation in the next 30 days. osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb, someone with administrative access to…
CVE-2020-11081, published 2020-07-10. High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days. osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll…
CVE-2018-6336, published 2018-12-31. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of…