]> git.ipfire.org Git - thirdparty/util-linux.git/commit
chsh, chfn: remove readline support [CVE-2022-0563]
authorKarel Zak <kzak@redhat.com>
Thu, 10 Feb 2022 11:03:17 +0000 (12:03 +0100)
committerKarel Zak <kzak@redhat.com>
Mon, 14 Feb 2022 11:27:40 +0000 (12:27 +0100)
commitfaa5a3a83ad0cb5e2c303edbfd8cd823c9d94c17
tree530cfd0c317576d1b274cb8c65d1224bcd67b746
parent43485143623b46f54ed3cac13f159566d32c3675
chsh, chfn: remove readline support [CVE-2022-0563]

The readline library uses INPUTRC= environment variable to get a path
to the library config file. When the library cannot parse the
specified file, it prints an error message containing data from the
file.

Unfortunately, the library does not use secure_getenv() (or a similar
concept) to avoid vulnerabilities that could occur if set-user-ID or
set-group-ID programs.

Reported-by: Rory Mackie <rory.mackie@trailofbits.com>
Signed-off-by: Karel Zak <kzak@redhat.com>
login-utils/Makemodule.am
login-utils/chfn.c
login-utils/chsh.c