Bug 795291 (CVE-2021-34363)

Summary:	<app-shells/thefuck-3.32: Arbitrary file deletion (CVE-2021-34363)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	me, proxy-maint
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~4 [noglsa]
Package list:		Runtime testing required:	---

Description Sam James archtester

2021-06-10 21:34:19 UTC

Description:
"The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature."

https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092
https://github.com/nvbn/thefuck/releases/tag/3.31
https://vuln.ryotak.me/advisories/48

Please bump to 3.31.

Comment 1 NATTkA bot gentoo-dev

2021-07-29 17:21:49 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 2 NATTkA bot gentoo-dev

2021-07-29 17:29:59 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 3 NATTkA bot gentoo-dev

2021-07-29 17:37:57 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 4 NATTkA bot gentoo-dev

2021-07-29 17:46:04 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 5 NATTkA bot gentoo-dev

2021-07-29 18:02:00 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 6 NATTkA bot gentoo-dev

2021-07-29 18:10:20 UTC

Package list is empty or all packages have requested keywords.

Comment 7 John Helmert III archtester

2021-08-07 21:51:09 UTC

Ping, needs bump

Comment 8 John Helmert III archtester

2022-08-15 04:32:42 UTC

Please cleanup.

Comment 9 Larry the Git Cow gentoo-dev

2022-08-15 04:45:29 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=84cc843cb3f03af6adef424d511c0a9e956a8dca

commit 84cc843cb3f03af6adef424d511c0a9e956a8dca
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2022-08-15 04:45:05 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-08-15 04:45:05 +0000

    app-shells/thefuck: drop 3.30
    
    Bug: https://bugs.gentoo.org/795291
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 app-shells/thefuck/Manifest            |  1 -
 app-shells/thefuck/thefuck-3.30.ebuild | 41 ----------------------------------
 2 files changed, 42 deletions(-)

Comment 10 John Helmert III archtester

2022-08-15 04:47:20 UTC

Tree clean, no GLSA, all done!