Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Dec 2013 14:49:25 +0100
From: Salvatore Bonaccorso <>
To: OSS Security Mailinglist <>
Cc: Axel Beckert <>
Subject: CVE Request: ack-grep: potential remote code execution via
 per-project .ackrc files


I would like to request a CVE for the following vulnerability in

Upstream for ack-grep fixed a security issue which could possibly lead
to a remote code execution:

2.12    Tue Dec  3 07:05:02 CST 2013
This verison of ack prevents the --pager, --regex and --output
options from being used from project-level ackrc files.  It is
possible to execute malicious code with these options, and we want
to prevent the security risk of acking through a potentially malicious
codebase, such as one downloaded from an Internet site or checked
out from a code repository.
The --pager, --regex and --output options may still be used from
the global /etc/ackrc, your own private ~/.ackrc, the ACK_OPTIONS
environment variable, and of course from the command line.

The relevant commit seems to be

(plus some adjusting the testsuite).

Reference in the Debian Bugtracker:

See also which contains further
restrictions to the command line options.

Could a CVE be assigned to this issue?


Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.