erroneo.us
Search all guides⌘K

Security Digest · Critical advisory (no CVE assigned)

GHSA-vrpv-vw92-328g: Multiple rtmpdump vulnerabilities

The version of rtmpdump contained in this package has multiple known vulnerabilities.

GitHub-reviewed · critical

Published By erroneo.us Security DeskSeen in the digest for Feb 6, 2025

Should you act?

  • Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with composer audit.
  • No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

EcosystemPackageVulnerableFirst fixed
Composer (PHP)rudloff/rtmpdump-bin<= 2.3.1none listed

Details

The version of rtmpdump contained in this package has multiple known vulnerabilities.

Patches This package is abandoned and should not be used anymore. There is no patched release.

Workarounds You should install rmtpdump from another source.

References https://github.com/advisories/GHSA-fm48-q5qq-894j https://github.com/advisories/GHSA-pfv7-grcx-8gcc https://github.com/advisories/GHSA-hg4c-2mw4-gwpm

Sources and references

  1. GitHub Advisory GHSA-vrpv-vw92-328g github.com
  2. github.com github.com
  3. github.com github.com
  4. github.com github.com
  5. github.com github.com

Critical Composer (PHP) advisories · Today’s Security Digest