Bugzilla – Bug 1222849
VUL-0: CVE-2024-32487: less: mishandling of \n character in paths when LESSOPEN is set leads to OS command execution
Last modified: 2024-07-15 09:30:01 UTC
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32487 https://www.cve.org/CVERecord?id=CVE-2024-32487 https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33 http://www.openwall.com/lists/oss-security/2024/04/12/5 http://www.openwall.com/lists/oss-security/2024/04/13/2 https://github.com/gwsw/less/commit/007521ac3c95bc76 https://gitlab.archlinux.org/archlinux/packaging/packages/less/-/commit/1d570db0c84fe95799f460526492e45e24c30ad0 https://bugzilla.redhat.com/show_bug.cgi?id=2274980 https://seclists.org/oss-sec/2024/q2/117
SUSE-SU-2024:1534-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1222849 CVE References: CVE-2024-32487 Maintenance Incident: [SUSE:Maintenance:33614](https://smelt.suse.de/incident/33614/) Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): less-530-150000.3.9.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): less-530-150000.3.9.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): less-530-150000.3.9.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): less-530-150000.3.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): less-530-150000.3.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): less-530-150000.3.9.1 SUSE Enterprise Storage 7.1 (src): less-530-150000.3.9.1 SUSE Linux Enterprise Micro 5.1 (src): less-530-150000.3.9.1 SUSE Linux Enterprise Micro 5.2 (src): less-530-150000.3.9.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): less-530-150000.3.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1550-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1222849 CVE References: CVE-2024-32487 Maintenance Incident: [SUSE:Maintenance:33613](https://smelt.suse.de/incident/33613/) Sources used: SUSE Linux Enterprise High Performance Computing 12 SP5 (src): less-458-7.15.1 SUSE Linux Enterprise Server 12 SP5 (src): less-458-7.15.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): less-458-7.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1598-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1222849 CVE References: CVE-2024-32487 Maintenance Incident: [SUSE:Maintenance:33612](https://smelt.suse.de/incident/33612/) Sources used: openSUSE Leap 15.4 (src): less-590-150400.3.9.1 openSUSE Leap Micro 5.3 (src): less-590-150400.3.9.1 openSUSE Leap Micro 5.4 (src): less-590-150400.3.9.1 openSUSE Leap 15.5 (src): less-590-150400.3.9.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): less-590-150400.3.9.1 SUSE Linux Enterprise Micro 5.3 (src): less-590-150400.3.9.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): less-590-150400.3.9.1 SUSE Linux Enterprise Micro 5.4 (src): less-590-150400.3.9.1 SUSE Linux Enterprise Micro 5.5 (src): less-590-150400.3.9.1 Basesystem Module 15-SP5 (src): less-590-150400.3.9.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): less-590-150400.3.9.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): less-590-150400.3.9.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): less-590-150400.3.9.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): less-590-150400.3.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): less-590-150400.3.9.1 SUSE Manager Proxy 4.3 (src): less-590-150400.3.9.1 SUSE Manager Retail Branch Server 4.3 (src): less-590-150400.3.9.1 SUSE Manager Server 4.3 (src): less-590-150400.3.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
dspinella leaves SUSE. Taking the package, but I am leaving for vacation. Antonio is a backup.
Fixes were backported to: SUSE:SLE-15-SP6:Update/less: https://build.suse.de/request/show/335217 SUSE:ALP:Source:Standard:1.0/less: https://build.suse.de/request/show/335218 SUSE:SLFO:Main/less: https://build.suse.de/request/show/335219
SUSE-SU-2024:2060-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1222849 CVE References: CVE-2024-32487 Maintenance Incident: [SUSE:Maintenance:34274](https://smelt.suse.de/incident/34274/) Sources used: openSUSE Leap 15.6 (src): less-643-150600.3.3.1 Basesystem Module 15-SP6 (src): less-643-150600.3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Everything is done. Just SLFO and ALP packages are still waiting for check-in. openSUSE:Factory has the version 6.56, which is already fixed.