|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2022-41751: jhead: arbitrary OS commands by placing them in a JPEG filename | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE Distribution | Reporter: | Thomas Leroy <thomas.leroy> |
| Component: | Security | Assignee: | Security Team bot <security-team> |
| Status: | IN_PROGRESS --- | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | david.anes, geoff, pgajdos, sbrabec |
| Version: | Leap 15.4 | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/345422/ | ||
| Whiteboard: | |||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Thomas Leroy
2022-10-18 07:43:17 UTC
Affected: - openSUSE:Backports:SLE-15-SP3 - openSUSE:Backports:SLE-15-SP4 - openSUSE:Factory I fixed it on all codestreams. The following 2 patches were needed: * https://github.com/Matthias-Wandel/jhead/pull/57 * https://github.com/Matthias-Wandel/jhead/commit/ec67262b8e5a4b05d8ad6898a09f1dc3fc032062 Codestream Vers. Request ---------------------------------------------------------------------- Backports:SLE-15-SP3:Update 3.00 https://build.opensuse.org/request/show/1031582 Backports:SLE-15-SP4:Update 3.06.0.1 https://build.opensuse.org/request/show/1031581 Factory 3.06.0.1 https://build.opensuse.org/request/show/1031580 Feel free to send to security as you review, Standa. openSUSE-SU-2022:10178-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1204409 CVE References: CVE-2022-41751 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): jhead-3.00-bp153.3.3.1 This is an autogenerated message for OBS integration: This bug (1204409) was mentioned in https://build.opensuse.org/request/show/1032523 Factory / jhead openSUSE-SU-2022:10179-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1204409 CVE References: CVE-2022-41751 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): jhead-3.06.0.1-bp154.2.3.1 I think that everything is done. But as it is a security bug, reassigning to Security Team to check and close. I don't think the fix is correct; in some cases jhead appears to invoke helper programs incorrectly. Consider: [take a photo in portrait mode and download it] bow:2:636> jhead -autorot IMG_2132.JPG Nonfatal Error : 'IMG_2132.JPG' Command has invalid characters. That message does not come from jhead, nor from jpegtran (which it invokes). I'm guessing the shell but I didn't have time to debug it further. This behavior is new in Leap 15.4. This may be related to bug 1207150, which I missed in my previous searches. (In reply to Geoff Kuenning from comment #8) > This may be related to bug 1207150, which I missed in my previous searches. Yeah, let's discuss in bug 1207150. |