Fish: User-assisted execution of arbitrary code — GLSA 202309-10

A vulnerability was discovered in Fish when handling git repository configuration that may lead to execution of arbitrary code

Affected packages

Background

Smart and user-friendly command line shell for macOS, Linux, and the rest of the family. It includes features like syntax highlighting, autosuggest-as-you-type, and fancy tab completions that just work, with no configuration required.

Description

A vulnerability have been discovered in Fish. Please review the CVE identifiers referenced below for details.

Impact

A user may be enticed to cd into a git repository under control by an attacker (e.g. on a shared filesystem or by unpacking an archive) and execute arbitrary commands.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-shells/fish-3.4.0"
 

References

• CVE-2022-20001

Release date
September 29, 2023

Latest revision
September 29, 2023: 1

Severity
normal

Exploitable
local

Bugzilla entries

• 835337