Bugzilla – Full Text Bug Listing
|Summary:||VUL-0: CVE-2022-41751: jhead: arbitrary OS commands by placing them in a JPEG filename|
|Product:||[openSUSE] openSUSE Distribution||Reporter:||Thomas Leroy <thomas.leroy>|
|Component:||Security||Assignee:||Security Team bot <security-team>|
|Status:||IN_PROGRESS ---||QA Contact:||Security Team bot <security-team>|
|Priority:||P3 - Medium||CC:||david.anes, geoff, pgajdos, sbrabec|
|Found By:||Security Response Team||Services Priority:|
|Marketing QA Status:||---||IT Deployment:||---|
Description Thomas Leroy 2022-10-18 07:43:17 UTC
Comment 1 Thomas Leroy 2022-10-18 07:49:59 UTC
Affected: - openSUSE:Backports:SLE-15-SP3 - openSUSE:Backports:SLE-15-SP4 - openSUSE:Factory
Comment 2 David Anes 2022-10-27 16:26:27 UTC
I fixed it on all codestreams. The following 2 patches were needed: * https://github.com/Matthias-Wandel/jhead/pull/57 * https://github.com/Matthias-Wandel/jhead/commit/ec67262b8e5a4b05d8ad6898a09f1dc3fc032062 Codestream Vers. Request ---------------------------------------------------------------------- Backports:SLE-15-SP3:Update 3.00 https://build.opensuse.org/request/show/1031582 Backports:SLE-15-SP4:Update 3.06.0.1 https://build.opensuse.org/request/show/1031581 Factory 3.06.0.1 https://build.opensuse.org/request/show/1031580 Feel free to send to security as you review, Standa.
Comment 3 Swamp Workflow Management 2022-10-31 14:43:28 UTC
openSUSE-SU-2022:10178-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1204409 CVE References: CVE-2022-41751 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): jhead-3.00-bp22.214.171.124
Comment 4 OBSbugzilla Bot 2022-10-31 14:45:03 UTC
This is an autogenerated message for OBS integration: This bug (1204409) was mentioned in https://build.opensuse.org/request/show/1032523 Factory / jhead
Comment 5 Swamp Workflow Management 2022-10-31 14:46:02 UTC
openSUSE-SU-2022:10179-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1204409 CVE References: CVE-2022-41751 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): jhead-3.06.0.1-bp126.96.36.199
Comment 6 Stanislav Brabec 2022-11-08 13:06:30 UTC
I think that everything is done. But as it is a security bug, reassigning to Security Team to check and close.
Comment 7 Geoff Kuenning 2023-01-22 02:07:36 UTC
I don't think the fix is correct; in some cases jhead appears to invoke helper programs incorrectly. Consider: [take a photo in portrait mode and download it] bow:2:636> jhead -autorot IMG_2132.JPG Nonfatal Error : 'IMG_2132.JPG' Command has invalid characters. That message does not come from jhead, nor from jpegtran (which it invokes). I'm guessing the shell but I didn't have time to debug it further. This behavior is new in Leap 15.4.
Comment 8 Geoff Kuenning 2023-01-22 08:40:31 UTC
This may be related to bug 1207150, which I missed in my previous searches.
Comment 9 Petr Gajdos 2023-02-10 12:09:41 UTC
(In reply to Geoff Kuenning from comment #8) > This may be related to bug 1207150, which I missed in my previous searches. Yeah, let's discuss in bug 1207150.