Bug 919488 (CVE-2023-49284)

Summary:	<app-shells/fish-3.7.0: command substitution output can trigger shell expansion
Product:	Gentoo Security	Reporter:	Christopher Fore <csfore>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	gyakovlev, maintainer-needed
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/fish-shell/fish-shell/security/advisories/GHSA-2j9r-pm96-wp4f
Whiteboard:	B3 [stable?]
Package list:		Runtime testing required:	---

Description Christopher Fore 2023-12-08 20:01:40 UTC

CVE-2023-49284 (https://github.com/fish-shell/fish-shell/security/advisories/GHSA-2j9r-pm96-wp4f):

fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation.

While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. 

The above has been fixed in 3.6.2

Comment 1 Mike Limansky 2023-12-18 14:15:07 UTC

Hi,

 I've checked simple bump from 3.6.1 to 3.6.4 and it works fine for me.