Bug 1204409 - (CVE-2022-41751) VUL-0: CVE-2022-41751: jhead: arbitrary OS commands by placing them in a JPEG filename
(CVE-2022-41751)
VUL-0: CVE-2022-41751: jhead: arbitrary OS commands by placing them in a JPEG...
Status: IN_PROGRESS
Classification: openSUSE
Product: openSUSE Distribution
Classification: openSUSE
Component: Security
Leap 15.4
Other Other
: P3 - Medium : Normal (vote)
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/345422/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-10-18 07:43 UTC by Thomas Leroy
Modified: 2023-01-22 08:40 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Thomas Leroy 2022-10-18 07:49:59 UTC
Affected:
- openSUSE:Backports:SLE-15-SP3
- openSUSE:Backports:SLE-15-SP4
- openSUSE:Factory
Comment 2 David Anes 2022-10-27 16:26:27 UTC
I fixed it on all codestreams.

The following 2 patches were needed:
* https://github.com/Matthias-Wandel/jhead/pull/57
* https://github.com/Matthias-Wandel/jhead/commit/ec67262b8e5a4b05d8ad6898a09f1dc3fc032062

Codestream                   Vers.  Request
----------------------------------------------------------------------
Backports:SLE-15-SP3:Update 3.00     https://build.opensuse.org/request/show/1031582
Backports:SLE-15-SP4:Update 3.06.0.1 https://build.opensuse.org/request/show/1031581
Factory                     3.06.0.1 https://build.opensuse.org/request/show/1031580

Feel free to send to security as you review, Standa.
Comment 3 Swamp Workflow Management 2022-10-31 14:43:28 UTC
openSUSE-SU-2022:10178-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1204409
CVE References: CVE-2022-41751
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP3 (src):    jhead-3.00-bp153.3.3.1
Comment 4 OBSbugzilla Bot 2022-10-31 14:45:03 UTC
This is an autogenerated message for OBS integration:
This bug (1204409) was mentioned in
https://build.opensuse.org/request/show/1032523 Factory / jhead
Comment 5 Swamp Workflow Management 2022-10-31 14:46:02 UTC
openSUSE-SU-2022:10179-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1204409
CVE References: CVE-2022-41751
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP4 (src):    jhead-3.06.0.1-bp154.2.3.1
Comment 6 Stanislav Brabec 2022-11-08 13:06:30 UTC
I think that everything is done. But as it is a security bug, reassigning to Security Team to check and close.
Comment 7 Geoff Kuenning 2023-01-22 02:07:36 UTC
I don't think the fix is correct; in some cases jhead appears to invoke helper programs incorrectly.  Consider:

[take a photo in portrait mode and download it]
bow:2:636> jhead -autorot IMG_2132.JPG 

Nonfatal Error : 'IMG_2132.JPG' Command has invalid characters.

That message does not come from jhead, nor from jpegtran (which it invokes).  I'm guessing the shell but I didn't have time to debug it further.

This behavior is new in Leap 15.4.
Comment 8 Geoff Kuenning 2023-01-22 08:40:31 UTC
This may be related to bug 1207150, which I missed in my previous searches.