1*4882a593SmuzhiyunFrom 4abf2fc193fc2f3e680deecbf81289a7b02e245b Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: dana <dana@dana.is> 3*4882a593SmuzhiyunDate: Tue, 21 Dec 2021 13:13:33 -0600 4*4882a593SmuzhiyunSubject: [PATCH 3/9] CVE-2021-45444: Update NEWS/README 5*4882a593Smuzhiyun 6*4882a593Smuzhiyunhttps://salsa.debian.org/debian/zsh/-/blob/debian/5.8-6+deb11u1/debian/patches/cherry-pick-CVE-2021-45444_3.patch 7*4882a593SmuzhiyunUpstream-Status: Backport 8*4882a593SmuzhiyunCVE: CVE-2021-45444 9*4882a593SmuzhiyunSigned-off-by: Chee Yang Lee <chee.yang.lee@intel.com> 10*4882a593Smuzhiyun--- 11*4882a593Smuzhiyun ChangeLog | 2 ++ 12*4882a593Smuzhiyun NEWS | 20 ++++++++++++++++++++ 13*4882a593Smuzhiyun README | 6 ++++++ 14*4882a593Smuzhiyun 3 files changed, 28 insertions(+) 15*4882a593Smuzhiyun 16*4882a593Smuzhiyundiff --git a/ChangeLog b/ChangeLog 17*4882a593Smuzhiyunindex 9a05a09e1..93b0bc337 100644 18*4882a593Smuzhiyun--- a/ChangeLog 19*4882a593Smuzhiyun+++ b/ChangeLog 20*4882a593Smuzhiyun@@ -1,5 +1,7 @@ 21*4882a593Smuzhiyun 2022-01-27 dana <dana@dana.is> 22*4882a593Smuzhiyun 23*4882a593Smuzhiyun+ * CVE-2021-45444: NEWS, README: Document preceding two changes 24*4882a593Smuzhiyun+ 25*4882a593Smuzhiyun * Marc Cornellà: security/89: 26*4882a593Smuzhiyun Etc/CVE-2021-45444-VCS_Info-workaround.patch: Add patch which 27*4882a593Smuzhiyun can optionally be used to work around recursive PROMPT_SUBST 28*4882a593Smuzhiyundiff --git a/NEWS b/NEWS 29*4882a593Smuzhiyunindex 964e1633f..d34b3f79e 100644 30*4882a593Smuzhiyun--- a/NEWS 31*4882a593Smuzhiyun+++ b/NEWS 32*4882a593Smuzhiyun@@ -4,6 +4,26 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH 33*4882a593Smuzhiyun 34*4882a593Smuzhiyun Note also the list of incompatibilities in the README file. 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun+Changes since 5.8 37*4882a593Smuzhiyun+----------------- 38*4882a593Smuzhiyun+ 39*4882a593Smuzhiyun+CVE-2021-45444: Some prompt expansion sequences, such as %F, support 40*4882a593Smuzhiyun+'arguments' which are themselves expanded in case they contain colour 41*4882a593Smuzhiyun+values, etc. This additional expansion would trigger PROMPT_SUBST 42*4882a593Smuzhiyun+evaluation, if enabled. This could be abused to execute code the user 43*4882a593Smuzhiyun+didn't expect. e.g., given a certain prompt configuration, an attacker 44*4882a593Smuzhiyun+could trick a user into executing arbitrary code by having them check 45*4882a593Smuzhiyun+out a Git branch with a specially crafted name. 46*4882a593Smuzhiyun+ 47*4882a593Smuzhiyun+This is fixed in the shell itself by no longer performing PROMPT_SUBST 48*4882a593Smuzhiyun+evaluation on these prompt-expansion arguments. 49*4882a593Smuzhiyun+ 50*4882a593Smuzhiyun+Users who are concerned about an exploit but unable to update their 51*4882a593Smuzhiyun+binaries may apply the partial work-around described in the file 52*4882a593Smuzhiyun+'Etc/CVE-2021-45444 VCS_Info workaround.patch' included with the shell 53*4882a593Smuzhiyun+source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to 54*4882a593Smuzhiyun+Marc Cornellà <hello@mcornella.com>. ] 55*4882a593Smuzhiyun+ 56*4882a593Smuzhiyun Changes since 5.7.1-test-3 57*4882a593Smuzhiyun -------------------------- 58*4882a593Smuzhiyun 59*4882a593Smuzhiyundiff --git a/README b/README 60*4882a593Smuzhiyunindex 7f1dd5f92..c9e994ab3 100644 61*4882a593Smuzhiyun--- a/README 62*4882a593Smuzhiyun+++ b/README 63*4882a593Smuzhiyun@@ -31,6 +31,12 @@ Zsh is a shell with lots of features. For a list of some of these, see the 64*4882a593Smuzhiyun file FEATURES, and for the latest changes see NEWS. For more 65*4882a593Smuzhiyun details, see the documentation. 66*4882a593Smuzhiyun 67*4882a593Smuzhiyun+Incompatibilities since 5.8 68*4882a593Smuzhiyun+--------------------------- 69*4882a593Smuzhiyun+ 70*4882a593Smuzhiyun+PROMPT_SUBST expansion is no longer performed on arguments to prompt- 71*4882a593Smuzhiyun+expansion sequences such as %F. 72*4882a593Smuzhiyun+ 73*4882a593Smuzhiyun Incompatibilities since 5.7.1 74*4882a593Smuzhiyun ----------------------------- 75*4882a593Smuzhiyun 76*4882a593Smuzhiyun-- 77*4882a593Smuzhiyun2.34.1 78