CVE-2024-58266

Issue 1: Failure to quote characters

Affected versions of this crate allowed the bytes { and \xa0 to appear unquoted and unescaped in command arguments.

If the output of quote or join is passed to a shell, then what should be a single command argument could be interpreted as multiple arguments.

This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution.

The flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired.

Workaround: Check for the bytes { and \xa0 in quote/join input or output.

(Note: { is problematic because it is used for glob expansion. \xa0 is problematic because it's treated as a word separator in specific environments.)

Issue 2: Dangerous API w.r.t. nul bytes

Version 1.3.0 deprecates the quote and join APIs in favor of try_quote and try_join, which behave the same except that they have Result return type, returning Err if the input contains nul bytes.

Strings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally. If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios. More details here.

Due to the low severity, the behavior of the original quote and join APIs has not changed; they continue to allow nuls.

Workaround: Manually check for nul bytes in quote/join input or output.

Issue 3: Lack of documentation for interactive shell risks

The quote family of functions does not and cannot escape control characters. With non-interactive shells this is perfectly safe, as control characters have no special effect. But if you writing directly to the standard input of an interactive shell (or through a pty), then control characters can cause misbehavior including arbitrary command injection.

This is essentially unfixable, and has not been patched. But as of version 1.3.0, documentation has been added.

Future versions of shlex may add API variants that avoid the issue at the cost of reduced portability.

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

These are all security issues fixed in the framework-inputmodule-control-0.2.0-3.1 package on the GA media of openSUSE Tumbleweed.

Issue 1: Failure to quote characters

Affected versions of this crate allowed the bytes { and \xa0 to appear unquoted and unescaped in command arguments.

If the output of quote or join is passed to a shell, then what should be a single command argument could be interpreted as multiple arguments.

This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution.

The flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired.

Workaround: Check for the bytes { and \xa0 in quote/join input or output.

(Note: { is problematic because it is used for glob expansion. \xa0 is problematic because it's treated as a word separator in specific environments.)

Issue 2: Dangerous API w.r.t. nul bytes

Version 1.3.0 deprecates the quote and join APIs in favor of try_quote and try_join, which behave the same except that they have Result return type, returning Err if the input contains nul bytes.

Strings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally. If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios. More details here.

Due to the low severity, the behavior of the original quote and join APIs has not changed; they continue to allow nuls.

Workaround: Manually check for nul bytes in quote/join input or output.

Issue 3: Lack of documentation for interactive shell risks

The quote family of functions does not and cannot escape control characters. With non-interactive shells this is perfectly safe, as control characters have no special effect. But if you writing directly to the standard input of an interactive shell (or through a pty), then control characters can cause misbehavior including arbitrary command injection.

This is essentially unfixable, and has not been patched. But as of version 1.3.0, documentation has been added.

Future versions of shlex may add API variants that avoid the issue at the cost of reduced portability.

This update for rav1e fixes the following issues:

• CVE-2024-58266: shlex: Fixed certain bytes allowed to appear unquoted and unescaped in command arguments (bsc#1247207)

This update for rav1e fixes the following issues:

• Update crate shlex to 1.3.0:
  • CVE-2024-58266: Fixed command injection (bsc#1247207)
  • RUSTSEC-2024-0006: Fixed multiple issues involving quote API (bsc#1230028)

This update for rust-keylime fixes the following issues:

• Update vendored crate slab to version 0.4.11

  • CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function leading to undefined behavior or potential crash due to out-of-bounds access (bsc#1248006)

• Update to version 0.2.8+12:

  • build(deps): bump actions/checkout from 4 to 5
  • build(deps): bump cfg-if from 1.0.0 to 1.0.1
  • build(deps): bump openssl from 0.10.72 to 0.10.73
  • build(deps): bump clap from 4.5.39 to 4.5.45
  • build(deps): bump pest from 2.8.0 to 2.8.1
  • Fix clippy warnings
  • Use verifier-provided interval for continuous attestation timing
  • Add meta object with seconds_to_next_attestation to evidence response
  • Fix boot time retrieval
  • Fix IMA log format (it must be ['text/plain']) (#1073)
  • Remove unnecessary configuration fields
  • cargo: Bump retry-policies to version 0.4.0

• Update vendored crate shlex to version 1.3.0

  • CVE-2024-58266: Fixed command injection (bsc#1247193)

• Update to version 0.2.7+141:

  • service: Use WantedBy=multi-user.target
  • rpm: Add subpackage for push-attestation agent
  • push-model: implement continuous attestation with configurable intervals
  • Retry registration forever in the state machine
  • Add Verifier URL to configuration
  • Align exp.backoff to current configuration format
  • Increase coverage of state machine (using Context)
  • Increase coverage of struct_filler.rs
  • Groom code (remove dead code)
  • Fix exponential backoff (10secs, 4xx accepted)
  • test: Add documentation test to tests/run.sh
  • tpm: Avoid running code example during documentation tests
  • state_machine: Always start the agent from the Unregistered state
  • Add fixes for the URL construction
  • Refactor evidences collection in push attestation agent
  • push-model: refactor attestation logic into a state machine
  • Fix body sending by allowing serializing strings (#1057)
  • Log ResilientClient errors/response status codes (#1055)
  • Add AK signing scheme and hash algorithm to negotiation
  • tpm: Add method to extract signing scheme and hash algorithm from AK
  • Allow custom content-type/accept headers
  • Integrate exponential backoff to registration (#1052)
  • keylime/structures: Rename ShaValues to PcrBanks
  • Add resilient_client for exponential backoff (#1048)

• Update vendored crate openssl 0.10.73:

  • CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch (bsc#1242623)

• Update to version 0.2.7+117:

  • Increase coverage in evidence handling structure
  • Add Capabilities Negotiations resp. missing fields
  • Fix UEFI test to check file access in all cases
  • context_info_handler: Do not assume /var/lib/keylime exists
  • Fix clippy warnings about uninlined format arguments
  • attestation: Allow unwrap() in tests
  • Increase coverage (groom code, extend unit tests)
  • Include IMA/UEFI logs in Evidence Handling request
  • Include method to get all IMA entries as string
  • Send correct list of pcr banks and sign algorithms
  • Try to fix TPM tests related issues
  • Define attestation perform asynchronous
  • Perform attestation in push model agent binary
  • Refactor code to use new attestation.rs
  • Create attestation.rs for Attestation stuff
  • Move ContextInfo management to its own handler
  • Adjust context_info.rs after rebase
  • Add attestation function to ContextInfo structure
  • Add prohibited signing algorithms, avoid ecschnorr
  • keylime/config: Use macro to implement PushModelConfigTrait
  • Introduce keylime-macros and define_view_trait
  • config: Remove KeylimeConfig structure
  • config: Remove unnecessary options and lazy initialization
  • Fix pcr_bank function to send all possible slots
  • Send Content-Type:application/json on request (#1039)
  • Send correct 'key_algorithm' in certification_keys (#1035)
  • Push Model: Persist Attestation Key to file
  • Add Keylime push model binary to root GNUmakefile
  • Use…

This update for rust-keylime fixes the following issues:

• CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (bsc#1248006)

• CVE-2025-3416: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623)

• CVE-2024-58266: shlex: certain bytes allowed to appear unquoted and unescaped in command arguments (bsc#1247193)

• CVE-2024-43806: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952)

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861)

• RUSTSEC-2024-0006: Multiple issues involving quote API (bsc#1230029)