Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 529678 (CVE-2014-8990) - <app-admin/lsyncd-2.1.6: command injection through backticks in a filename
Summary: <app-admin/lsyncd-2.1.6: command injection through backticks in a filename
Alias: CVE-2014-8990
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [glsa cve]
Depends on: 562898
  Show dependency tree
Reported: 2014-11-18 11:15 UTC by Agostino Sarubbo
Modified: 2017-02-10 23:11 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-11-18 11:15:25 UTC
From ${URL} :

It was reported [1] that lsyncd is vulnerable to command injection.
If a filename has "`" (backticks), what betwwen backticks will be executed with lsyncd process privileges.
Upstream patch is at [2].


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2015-01-04 19:17:07 UTC
CVE-2014-8990 (
  default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to
  execute arbitrary commands via shell metacharacters in a filename.
Comment 2 Patrick Lauer gentoo-dev 2016-08-26 05:39:56 UTC
2.1.6 is in tree
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2017-02-01 09:27:06 UTC
GLSA request filed.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2017-02-10 23:11:41 UTC
This issue was resolved and addressed in
 GLSA 201702-05 at
by GLSA coordinator Thomas Deutschmann (whissi).