[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Dec 2013 14:49:25 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Cc: Axel Beckert <abe@...ian.org>
Subject: CVE Request: ack-grep: potential remote code execution via
per-project .ackrc files
Hi
I would like to request a CVE for the following vulnerability in
ack-grep:
https://github.com/petdance/ack2/issues/399
Upstream for ack-grep fixed a security issue which could possibly lead
to a remote code execution:
2.12 Tue Dec 3 07:05:02 CST 2013
====================================
[SECURITY FIXES]
This verison of ack prevents the --pager, --regex and --output
options from being used from project-level ackrc files. It is
possible to execute malicious code with these options, and we want
to prevent the security risk of acking through a potentially malicious
codebase, such as one downloaded from an Internet site or checked
out from a code repository.
The --pager, --regex and --output options may still be used from
the global /etc/ackrc, your own private ~/.ackrc, the ACK_OPTIONS
environment variable, and of course from the command line.
The relevant commit seems to be
https://github.com/petdance/ack2/commit/a9233abad71225c1cfb300c03841c723bceb0f07
(plus some adjusting the testsuite).
Reference in the Debian Bugtracker:
http://bugs.debian.org/731848
See also https://github.com/petdance/ack2/issues/414 which contains further
restrictions to the command line options.
Could a CVE be assigned to this issue?
Regards,
Salvatore
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
