Unrated
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command executi...
CVE-2021-40084
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-40084 opensysusers Fixed in: 0.6-3
- Ubuntu UBUNTU-CVE-2021-40084 opensysusers
Original description The description as published by the source.
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
References
- advisory github.com
- report bugs.debian.org