1From 4abf2fc193fc2f3e680deecbf81289a7b02e245b Mon Sep 17 00:00:00 2001 2From: dana <dana@dana.is> 3Date: Tue, 21 Dec 2021 13:13:33 -0600 4Subject: [PATCH 3/9] CVE-2021-45444: Update NEWS/README 5 6https://salsa.debian.org/debian/zsh/-/blob/debian/5.8-6+deb11u1/debian/patches/cherry-pick-CVE-2021-45444_3.patch 7Upstream-Status: Backport 8CVE: CVE-2021-45444 9Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> 10--- 11 ChangeLog | 2 ++ 12 NEWS | 20 ++++++++++++++++++++ 13 README | 6 ++++++ 14 3 files changed, 28 insertions(+) 15 16diff --git a/ChangeLog b/ChangeLog 17index 9a05a09e1..93b0bc337 100644 18--- a/ChangeLog 19+++ b/ChangeLog 20@@ -1,5 +1,7 @@ 21 2022-01-27 dana <dana@dana.is> 22 23+ * CVE-2021-45444: NEWS, README: Document preceding two changes 24+ 25 * Marc Cornellà: security/89: 26 Etc/CVE-2021-45444-VCS_Info-workaround.patch: Add patch which 27 can optionally be used to work around recursive PROMPT_SUBST 28diff --git a/NEWS b/NEWS 29index 964e1633f..d34b3f79e 100644 30--- a/NEWS 31+++ b/NEWS 32@@ -4,6 +4,26 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH 33 34 Note also the list of incompatibilities in the README file. 35 36+Changes since 5.8 37+----------------- 38+ 39+CVE-2021-45444: Some prompt expansion sequences, such as %F, support 40+'arguments' which are themselves expanded in case they contain colour 41+values, etc. This additional expansion would trigger PROMPT_SUBST 42+evaluation, if enabled. This could be abused to execute code the user 43+didn't expect. e.g., given a certain prompt configuration, an attacker 44+could trick a user into executing arbitrary code by having them check 45+out a Git branch with a specially crafted name. 46+ 47+This is fixed in the shell itself by no longer performing PROMPT_SUBST 48+evaluation on these prompt-expansion arguments. 49+ 50+Users who are concerned about an exploit but unable to update their 51+binaries may apply the partial work-around described in the file 52+'Etc/CVE-2021-45444 VCS_Info workaround.patch' included with the shell 53+source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to 54+Marc Cornellà <hello@mcornella.com>. ] 55+ 56 Changes since 5.7.1-test-3 57 -------------------------- 58 59diff --git a/README b/README 60index 7f1dd5f92..c9e994ab3 100644 61--- a/README 62+++ b/README 63@@ -31,6 +31,12 @@ Zsh is a shell with lots of features. For a list of some of these, see the 64 file FEATURES, and for the latest changes see NEWS. For more 65 details, see the documentation. 66 67+Incompatibilities since 5.8 68+--------------------------- 69+ 70+PROMPT_SUBST expansion is no longer performed on arguments to prompt- 71+expansion sequences such as %F. 72+ 73 Incompatibilities since 5.7.1 74 ----------------------------- 75 76-- 772.34.1 78