Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security risk with untrusted repositories (CVE-2022-42906) #45

Closed
jcharaoui opened this issue Oct 2, 2022 · 4 comments
Closed

Security risk with untrusted repositories (CVE-2022-42906) #45

jcharaoui opened this issue Oct 2, 2022 · 4 comments

Comments

@jcharaoui
Copy link
Collaborator

When powerline-gitstatus is enabled on the shell and a malicious repository is cloned on the system, simply entering the directory can lead to the execution of arbitrary commands. This risk is documented here: https://blog.sonarsource.com/securing-developer-tools-git-integrations/

We should implement the notion of trusted directories for this plugin, so that git status & friends are only executed known-good locations, as opposed to any location on any filesystem.

@jcharaoui
Copy link
Collaborator Author

jcharaoui commented Oct 9, 2022

The issue is identical to the one identified for the fish shell:

jcharaoui added a commit that referenced this issue Oct 9, 2022
This is a mitigation for #45 and is the same method that was implemented
by the fish shell maintainers in
fish-shell/fish-shell#8589
@jcharaoui
Copy link
Collaborator Author

Related PR: #46

@jcharaoui jcharaoui changed the title Security risk with untrusted repositories Security risk with untrusted repositories (CVE-2022-42906) Oct 13, 2022
@jcharaoui
Copy link
Collaborator Author

A CVE number has been assigned for this bug: CVE-2022-42906

@jcharaoui
Copy link
Collaborator Author

Fixed in v1.3.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant