CVE-2020-17367: Command Injection
Published Aug 11, 2020
·Updated
Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.
Affected Software
8 affected componentsFixes available
debian/firejail
0.9.58.2-2+deb10u30.9.64.4-2+deb11u10.9.72-2
debian/mediawiki
1:1.31.16-1+deb10u21:1.31.16-1+deb10u6
Firejail Project Firejail<=0.9.62
Debian Debian Linux=10.0
Fedoraproject Fedora=31
Fedoraproject Fedora=32
Debian Debian Linux=9.0
openSUSE Leap=15.2
Event History
Aug 11, 2020
CVE Published
via MITRE·03:58 PM
Data Sourced
via MITRE·03:58 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-17367.
2
What software is affected by this vulnerability?
Firejail version 0.9.62 is affected by this vulnerability.
3
What is the severity of CVE-2020-17367?
The severity of CVE-2020-17367 is high (CVSS score 7.8).
4
What is the impact of this vulnerability?
This vulnerability may lead to command injection.
5
How can I fix this vulnerability?
Update Firejail to version 0.9.64.4-2+deb11u1 or 0.9.72-2 to address this vulnerability.