You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
109 lines
3.4 KiB
109 lines
3.4 KiB
From 02e0f94fff27cad2ba4e65bdc4b21146b3bd9a97 Mon Sep 17 00:00:00 2001 |
|
From: Oliver Kiddle <opk@zsh.org> |
|
Date: Wed, 15 Dec 2021 01:56:40 +0100 |
|
Subject: [PATCH 1/2] security/41: Don't perform PROMPT_SUBST evaluation on |
|
%F/%K arguments |
|
|
|
Mitigates CVE-2021-45444 |
|
|
|
Upstream-commit: c187154f47697cdbf822c2f9d714d570ed4a0fd1 |
|
Signed-off-by: Kamil Dudka <kdudka@redhat.com> |
|
--- |
|
Src/prompt.c | 10 ++++++++++ |
|
1 file changed, 10 insertions(+) |
|
|
|
diff --git a/Src/prompt.c b/Src/prompt.c |
|
index b65bfb8..91e21c8 100644 |
|
--- a/Src/prompt.c |
|
+++ b/Src/prompt.c |
|
@@ -244,6 +244,12 @@ parsecolorchar(zattr arg, int is_fg) |
|
bv->fm += 2; /* skip over F{ */ |
|
if ((ep = strchr(bv->fm, '}'))) { |
|
char oc = *ep, *col, *coll; |
|
+ int ops = opts[PROMPTSUBST], opb = opts[PROMPTBANG]; |
|
+ int opp = opts[PROMPTPERCENT]; |
|
+ |
|
+ opts[PROMPTPERCENT] = 1; |
|
+ opts[PROMPTSUBST] = opts[PROMPTBANG] = 0; |
|
+ |
|
*ep = '\0'; |
|
/* expand the contents of the argument so you can use |
|
* %v for example */ |
|
@@ -252,6 +258,10 @@ parsecolorchar(zattr arg, int is_fg) |
|
arg = match_colour((const char **)&coll, is_fg, 0); |
|
free(col); |
|
bv->fm = ep; |
|
+ |
|
+ opts[PROMPTSUBST] = ops; |
|
+ opts[PROMPTBANG] = opb; |
|
+ opts[PROMPTPERCENT] = opp; |
|
} else { |
|
arg = match_colour((const char **)&bv->fm, is_fg, 0); |
|
if (*bv->fm != '}') |
|
-- |
|
2.34.1 |
|
|
|
|
|
From 6102afb5dfd7c704f9cf99bedb9c3ec3c7dbe8e3 Mon Sep 17 00:00:00 2001 |
|
From: dana <dana@dana.is> |
|
Date: Tue, 21 Dec 2021 13:13:33 -0600 |
|
Subject: [PATCH 2/2] CVE-2021-45444: Update NEWS/README |
|
|
|
Upstream-commit: bdc4d70a7e033b754e68a8659a037ea0fc5f38de |
|
Signed-off-by: Kamil Dudka <kdudka@redhat.com> |
|
--- |
|
NEWS | 20 ++++++++++++++++++++ |
|
README | 6 ++++++ |
|
2 files changed, 26 insertions(+) |
|
|
|
diff --git a/NEWS b/NEWS |
|
index 964e163..327b449 100644 |
|
--- a/NEWS |
|
+++ b/NEWS |
|
@@ -4,6 +4,26 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH |
|
|
|
Note also the list of incompatibilities in the README file. |
|
|
|
+Changes since 5.8 |
|
+----------------- |
|
+ |
|
+CVE-2021-45444: Some prompt expansion sequences, such as %F, support |
|
+'arguments' which are themselves expanded in case they contain colour |
|
+values, etc. This additional expansion would trigger PROMPT_SUBST |
|
+evaluation, if enabled. This could be abused to execute code the user |
|
+didn't expect. e.g., given a certain prompt configuration, an attacker |
|
+could trick a user into executing arbitrary code by having them check |
|
+out a Git branch with a specially crafted name. |
|
+ |
|
+This is fixed in the shell itself by no longer performing PROMPT_SUBST |
|
+evaluation on these prompt-expansion arguments. |
|
+ |
|
+Users who are concerned about an exploit but unable to update their |
|
+binaries may apply the partial work-around described in the file |
|
+Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell |
|
+source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to |
|
+Marc Cornellà <hello@mcornella.com>. ] |
|
+ |
|
Changes since 5.7.1-test-3 |
|
-------------------------- |
|
|
|
diff --git a/README b/README |
|
index 7f1dd5f..c9e994a 100644 |
|
--- a/README |
|
+++ b/README |
|
@@ -31,6 +31,12 @@ Zsh is a shell with lots of features. For a list of some of these, see the |
|
file FEATURES, and for the latest changes see NEWS. For more |
|
details, see the documentation. |
|
|
|
+Incompatibilities since 5.8 |
|
+--------------------------- |
|
+ |
|
+PROMPT_SUBST expansion is no longer performed on arguments to prompt- |
|
+expansion sequences such as %F. |
|
+ |
|
Incompatibilities since 5.7.1 |
|
----------------------------- |
|
|
|
-- |
|
2.34.1 |
|
|
|
|