Bug 1219725 (CVE-2024-20328) - VUL-0: CVE-2024-20328: clamav: clamav: command injection vulnerability in the "VirusEvent" feature of ClamD service
Summary: VUL-0: CVE-2024-20328: clamav: clamav: command injection vulnerability in the...
Status: RESOLVED FIXED
Alias: CVE-2024-20328
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/393393/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-20328:7.4:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-08 09:32 UTC by SMASH SMASH
Modified: 2024-02-08 09:32 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-02-08 09:32:20 UTC 
CVE-2024-20328: Fixed a possible command injection vulnerability in the "VirusEvent" feature of ClamAV's ClamD service. To fix this issue, we disabled the '%f' format string parameter.  ClamD administrators may continue to use the `CLAM_VIRUSEVENT_FILENAME`  environment variable, instead of '%f'. But you should do so only from within  an executable, such as a Python script, and not directly in the clamd.conf "VirusEvent" command.

Affected versions:
0.104 (all patch versions)
0.105 (all patch versions)
1.0.0 through 1.0.4 (LTS)
1.1 (all patch versions)
1.2.0 and 1.2.1

References:
https://blog.clamav.net/2023/11/clamav-130-122-105-released.html

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-20328
https://bugzilla.redhat.com/show_bug.cgi?id=2263264

Patch:
https://github.com/Cisco-Talos/clamav/commit/fe7638287bb11419474ea314652404e7e9b314b2
Comment 1 Andrea Mattiazzo 2024-02-08 09:32:54 UTC 
Closed because all code streams are not affected.