mirrors/zsh
1
0
Fork 0
mirror of git://git.code.sf.net/p/zsh/code synced 2025-01-01 05:16:05 +01:00
Code Releases Activity

CVE-2021-45444: Update NEWS/README

Browse source 
(cherry picked from commit bdc4d70a7e)
This commit is contained in:
dana 2021-12-21 13:13:33 -06:00
parent d2df4c8ee4
commit f7fa575a59
3 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ChangeLog
View file

@ -1,5 +1,7 @@
2022-02-12 dana <dana@dana.is>
* CVE-2021-45444: NEWS, README: Document preceding two changes
* Marc Cornellà: security/89:
Etc/CVE-2021-45444-VCS_Info-workaround.patch: Add patch which
can optionally be used to work around recursive PROMPT_SUBST

17
NEWS
View file

@ -7,6 +7,23 @@ Note also the list of incompatibilities in the README file.
Changes since 5.8
-----------------
CVE-2021-45444: Some prompt expansion sequences, such as %F, support
'arguments' which are themselves expanded in case they contain colour
values, etc. This additional expansion would trigger PROMPT_SUBST
evaluation, if enabled. This could be abused to execute code the user
didn't expect. e.g., given a certain prompt configuration, an attacker
could trick a user into executing arbitrary code by having them check
out a Git branch with a specially crafted name.
This is fixed in the shell itself by no longer performing PROMPT_SUBST
evaluation on these prompt-expansion arguments.
Users who are concerned about an exploit but unable to update their
binaries may apply the partial work-around described in the file
Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell
source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to
Marc Cornellà <hello@mcornella.com>. ]
When unsetting a hash element, the string enclosed in square brackets is
interpreted literally after any normal command-line-argument expansions.
Thus

3
README
View file

@ -34,6 +34,9 @@ details, see the documentation.
Incompatibilities since 5.8
---------------------------
PROMPT_SUBST expansion is no longer performed on arguments to prompt-
expansion sequences such as %F.
Build-time change: The default value of the --enable-gdbm configure
argument has changed from "yes" to "no". Thus, the zsh/db/gdbm module will
not be built unless --enable-gdbm is passed explicitly.