CVE-2019-5443
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run th…
Published Jul 2, 2019 · updated Oct 14, 2026 · haxx curl
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Timeline
Detection, updates, and resolution for this record.
Jul 2, 2019 · NIST NVD
Detected
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Oct 14, 2026 · NIST NVD
Updated
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Affected
- cpe haxx/curlversion unspecified
- cpe netapp/oncommand insightversion unspecified
- cpe oracle/enterprise manager ops center12.3.3
- cpe oracle/enterprise manager ops center12.4.0
- cpe oracle/http server12.2.1.3.0
- cpe oracle/http server12.2.1.4.0
- cpe oracle/mysql serverversion unspecified
- cpe oracle/oss support tools20.0
Sources
- CVE.orgCVE-2019-5443
Official CVE identifier
cve.org - NIST NVDCVE-2019-5443
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it
nvd.nist.gov