me
/
guix
Archived
1
0
Fork 0
This repository has been archived on 2024-08-07. You can view files and clone it, but cannot push or open issues/pull-requests.
guix/gnu/packages/patches/newsbeuter-CVE-2017-12904.p...

35 lines
1.6 KiB
Diff
Raw Normal View History

Fix CVE-2017-12904:
https://github.com/akrennmair/newsbeuter/issues/591
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12904
Patch copied from the Debian package of newsbeuter, version 2.9-5+deb9u1.
Adapted from upstream source repository:
https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
Description: Fix a RCE vulnerability in the bookmark command
Newsbeuter didn't properly escape the title and description fields before
passing them to the bookmarking program which could lead to remote code
execution using the shells command substitution functionality (e.g. "$()", ``,
etc)
Origin: upstream, https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
Last-Update: 2017-08-18
--- newsbeuter-2.9.orig/src/controller.cpp
+++ newsbeuter-2.9/src/controller.cpp
@@ -1274,9 +1274,10 @@ std::string controller::bookmark(const s
std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd");
bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive");
if (bookmark_cmd.length() > 0) {
- std::string cmdline = utils::strprintf("%s '%s' %s %s",
+ std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'",
bookmark_cmd.c_str(), utils::replace_all(url,"'", "%27").c_str(),
- stfl::quote(title).c_str(), stfl::quote(description).c_str());
+ utils::replace_all(title,"'", "%27").c_str(),
+ utils::replace_all(description,"'", "%27").c_str());
LOG(LOG_DEBUG, "controller::bookmark: cmd = %s", cmdline.c_str());