* [ANNOUNCE] util-linux v2.37.4
@ 2022-02-14 11:06 Karel Zak
0 siblings, 0 replies; only message in thread
From: Karel Zak @ 2022-02-14 11:06 UTC (permalink / raw)
To: linux-kernel, linux-fsdevel, util-linux
The util-linux release v2.37.4 is available at
http://www.kernel.org/pub/linux/utils/util-linux/v2.37/
Feedback and bug reports, as always, are welcomed.
This release fixes security issue in chsh(1) and chfn(8) when
util-linux compiled with libreadline.
CVE-2022-0563
The readline library uses INPUTRC= environment variable to get a path
to the library config file. When the library cannot parse the
specified file, it prints an error message containing data from the
file.
Unfortunately, the library does not use secure_getenv() (or a similar
concept), or sanitize the config file path to avoid vulnerabilities that
could occur if set-user-ID or set-group-ID programs.
Note, this vulnerability has been reproduced on chfn(8), but this command
requires enabled CHFN_RESTRICT setting in /etc/login.defs. This setting
may be disabled by default.
--
Karel Zak <kzak@redhat.com>
http://karelzak.blogspot.com
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2022-02-14 11:28 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-14 11:06 [ANNOUNCE] util-linux v2.37.4 Karel Zak
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.