Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Fossil: User-assisted execution of arbitrary code — GLSA 201801-20

A vulnerability has been discovered in Fossil allowing for user-assisted remote execution of arbitrary code.

Affected packages

Package dev-vcs/fossil on all architectures
Affected versions < 2.4
Unaffected versions >= 2.4

Background

Fossil is a simple, high-reliability, distributed software configuration management system.

Description

Fossil does not properly validate SSH sync protocol URLs.

Impact

A remote attacker, by enticing a user to open a specially crafted URL, could possibly execute arbitrary commands with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All Fossil users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-vcs/fossil-2.4"

References

Release date
January 27, 2018

Latest revision
January 27, 2018: 1

Severity
normal

Exploitable
remote

Bugzilla entries