DSA-5234: -1 fish -- security update

Published Sep 21, 2022

Updated

An arbitrary code execution vulnerability was disovered in fish, a command line shell. When using the default configuraton of fish, changing to a directory automatically ran git commands in order to display information about the current repository in the prompt. Such repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands.

Affected Software

2 affected components

debian/fish

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade fish to a version that resolves this vulnerability.
Patch DSA-5234-1

Event History

Sep 21, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-20001

Frequently Asked Questions

Who is exposed to this issue?

Users of fish with its default prompt configuration are exposed when they change into a Git repository whose per-repository configuration has been crafted to alter Git behavior.

What interaction is required for exploitation?

The user must change directory into the affected Git repository. Fish then automatically runs Git commands to populate prompt repository information, which can trigger arbitrary commands through repository-specific Git configuration.

Are default fish installations affected?

Yes. The issue occurs with fish's default configuration because the default prompt automatically invokes Git commands when entering a repository.

DSA-5234: -1 fish -- security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What interaction is required for exploitation?

Are default fish installations affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What interaction is required for exploitation?

Are default fish installations affected?