Firejail through 0.9.62 does not honor the -- end-of... · CVE-2020-17367 · GitHub Advisory Database · GitHub

Firejail through 0.9.62 does not honor the -- end-of...

Moderate severity Unreviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Jan 29, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.

References

Published by the National Vulnerability Database

Aug 11, 2020

Published to the GitHub Advisory Database May 24, 2022

Last updated Jan 29, 2023

Weaknesses

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Learn more on MITRE.

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. Learn more on MITRE.