Arbitrary Command Execution in Debian Goodies by Debian
CVE-2023-27635

7.8HIGH

Key Information:

Vendor
Debian
Status
Debmany
Vendor
CVE Published:
5 March 2023

Summary

The debmany tool in debian-goodies version 0.88.1 is susceptible to a vulnerability that allows attackers to execute arbitrary shell commands. This is made possible due to an insecure eval call when processing a crafted .deb file, which may expose the command execution path to the user prior to execution, leading to potential exploitation.

References

https://bugs.debian.org/1031267

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.