Bugzilla – Bug 1204409
VUL-0: CVE-2022-41751: jhead: arbitrary OS commands by placing them in a JPEG filename
Last modified: 2023-02-10 12:09:41 UTC
rh#2135591 Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option. Reference: https://github.com/Matthias-Wandel/jhead/blob/63ce118c6a59ea64ac357236a11a47aaf569d622/jhead.c#L788 https://github.com/Matthias-Wandel/jhead/pull/57 References: https://bugzilla.redhat.com/show_bug.cgi?id=2135591 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-41751 https://www.cve.org/CVERecord?id=CVE-2022-41751 https://github.com/Matthias-Wandel/jhead/blob/63ce118c6a59ea64ac357236a11a47aaf569d622/jhead.c#L788 https://github.com/Matthias-Wandel/jhead/pull/57 https://github.com/Matthias-Wandel/jhead
Affected: - openSUSE:Backports:SLE-15-SP3 - openSUSE:Backports:SLE-15-SP4 - openSUSE:Factory
I fixed it on all codestreams. The following 2 patches were needed: * https://github.com/Matthias-Wandel/jhead/pull/57 * https://github.com/Matthias-Wandel/jhead/commit/ec67262b8e5a4b05d8ad6898a09f1dc3fc032062 Codestream Vers. Request ---------------------------------------------------------------------- Backports:SLE-15-SP3:Update 3.00 https://build.opensuse.org/request/show/1031582 Backports:SLE-15-SP4:Update 3.06.0.1 https://build.opensuse.org/request/show/1031581 Factory 3.06.0.1 https://build.opensuse.org/request/show/1031580 Feel free to send to security as you review, Standa.
openSUSE-SU-2022:10178-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1204409 CVE References: CVE-2022-41751 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): jhead-3.00-bp153.3.3.1
This is an autogenerated message for OBS integration: This bug (1204409) was mentioned in https://build.opensuse.org/request/show/1032523 Factory / jhead
openSUSE-SU-2022:10179-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1204409 CVE References: CVE-2022-41751 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): jhead-3.06.0.1-bp154.2.3.1
I think that everything is done. But as it is a security bug, reassigning to Security Team to check and close.
I don't think the fix is correct; in some cases jhead appears to invoke helper programs incorrectly. Consider: [take a photo in portrait mode and download it] bow:2:636> jhead -autorot IMG_2132.JPG Nonfatal Error : 'IMG_2132.JPG' Command has invalid characters. That message does not come from jhead, nor from jpegtran (which it invokes). I'm guessing the shell but I didn't have time to debug it further. This behavior is new in Leap 15.4.
This may be related to bug 1207150, which I missed in my previous searches.
(In reply to Geoff Kuenning from comment #8) > This may be related to bug 1207150, which I missed in my previous searches. Yeah, let's discuss in bug 1207150.