CVE-2020-17368: OS Command Injection
Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-17368?
CVE-2020-17368 is a vulnerability in Firejail through 0.9.62 that mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection.
What is the severity of CVE-2020-17368?
CVE-2020-17368 has a severity rating of 9.8 (critical).
Which software is affected by CVE-2020-17368?
CVE-2020-17368 affects Firejail versions 0.9.58.2-2+deb10u3, 0.9.64.4-2+deb11u1, and 0.9.72-2, as well as Debian Linux versions 9.0 and 10.0, Mediawiki versions 1:1.31.16-1+deb10u2 and 1:1.31.16-1+deb10u6, Fedora versions 31 and 32, and openSUSE Leap version 15.2.
How can CVE-2020-17368 be exploited?
CVE-2020-17368 can be exploited by an attacker injecting malicious commands through the --output or --output-stderr option in Firejail.
How can I mitigate the impact of CVE-2020-17368?
To mitigate the impact of CVE-2020-17368, it is recommended to update Firejail to a version that includes the fix, such as versions 0.9.58.2-2+deb10u3, 0.9.64.4-2+deb11u1, or 0.9.72-2, and follow any additional recommendations provided by the affected software vendors.