REDHAT-BUG-1249635: Command Injection
In scripts/licensecheck.pl, there is executed code, that is vulnerable to shell command injection via shell metacharacters in filename.
my $mime = file --brief --mime --dereference $file;
Upstream patch: https://anonscm.debian.org/cgit/collab-maint/devscripts.git/commit/?id=c0687bcde23108dd42e146573c368b6905e6b8e8
CVE assignment: http://www.openwall.com/lists/oss-security/2015/08/01/7
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1249635?
The severity of REDHAT-BUG-1249635 is considered high due to the potential for shell command injection.
How do I fix REDHAT-BUG-1249635?
To fix REDHAT-BUG-1249635, you should apply the appropriate upstream patch as outlined in the Debian devscripts repository.
What software is affected by REDHAT-BUG-1249635?
The software affected by REDHAT-BUG-1249635 is Debian devscripts.
What is the nature of the vulnerability in REDHAT-BUG-1249635?
The nature of the vulnerability in REDHAT-BUG-1249635 involves shell command injection through untrusted input in script licensecheck.pl.
Is shell command injection serious in REDHAT-BUG-1249635?
Yes, shell command injection in REDHAT-BUG-1249635 is serious as it allows an attacker to execute arbitrary commands on the system.