CVE-2021-45444

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.

The zsh is a shell designed for interactive use, and it is also a powerful scripting language. Many of the useful features of bash, ksh, and tcsh were incorporated into zsh. It can match files by file extension without running an external program, share command history with any shell, and more.

Security Fix(es):

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.(CVE-2021-45444)

The zsh is a shell designed for interactive use, and it is also a powerful scripting language. Many of the useful features of bash, ksh, and tcsh were incorporated into zsh. It can match files by file extension without running an external program, share command history with any shell, and more.

Security Fix(es):

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.(CVE-2021-45444)

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports command-line editing, built-in spelling correction, programmable command completion, shell functions (with autoloading), a history mechanism, and more.

Security Fix(es):

• zsh: Prompt expansion vulnerability (CVE-2021-45444)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports command-line editing, built-in spelling correction, programmable command completion, shell functions (with autoloading), a history mechanism, and more.

Security Fix(es):

• zsh: Prompt expansion vulnerability (CVE-2021-45444)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• SECURITY UPDATE: Regain dropped privileges
  • debian/patches/CVE-2019-20044-pre.patch: change the order of the calls to setgid (this should go first) and setuid in Src/options.c.
  • debian/patches/CVE-2019-20044-1.patch: add extra checks to drop privileges securely in Src/options.c.
  • debian/patches/CVE-2019-20044-2.patch: add Src/openssh_bsd_setres_id.c and its object file to Src/zsh.mdd, fix some of the checks from the previous patch in Src/options.c, update compatibility wrappers in Src/zsh_system.h, update the uid/gid methods in AC_CHECK_FUNCS in configure.ac and add a test in Test/E01options.ztst.
  • debian/patches/CVE-2019-20044-3.patch: improve Src/options.c changes from above two patches.
  • debian/patches/CVE-2019-20044-4.patch: clean up white spaces in Src/options.c.
  • debian/patches/CVE-2019-20044-5.patch: add privileged tests to Test/P01privileged.ztst, remove the notes on privileged test in Test/E01options.ztst and add the prilived tests to the Test/README.
  • CVE-2019-20044
• SECURITY UPDATE: Arbitrary code execution
  • debian/patches/CVE-2021-45444.patch: save PROMPTSUBST option before the call to promptexpand() in b/Src/prompt.c and restore after it is executed.
  • CVE-2021-45444

• CVE-2021-45444: do not expand PROMPT_SUBST within argument of prompt-expansion sequences such as file.file to avoid arbitrary code execution

• CVE-2021-45444: do not expand PROMPT_SUBST within argument of prompt-expansion sequences such as file.file to avoid arbitrary code execution

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion. (CVE-2021-45444)

This update for zsh fixes the following issues:

• CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion (bsc#1196435).
• CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEGED option (bsc#1163882).

These are all security issues fixed in the zsh-5.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for zsh fixes the following issues:

• CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion (bsc#1196435).
• CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEGED option (bsc#1163882).

This update for zsh fixes the following issues:

• CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion (bsc#1196435).
• CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEGED option (bsc#1163882).
• CVE-2018-1100: Fixed a potential code execution via a stack-based buffer overflow in utils.c:checkmailpath() (bsc#1089030).

This update for zsh fixes the following issues:

• CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion (bsc#1196435).
• CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEGED option (bsc#1163882).

Sam Foxman discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issue to regain dropped privileges. (CVE-2019-20044)

It was discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-45444)