OS Command Injection in pacman - CVE-2019-18182
Published: October 23, 2019
Vulnerability identifier: #VU22197
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-18182
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within the the download_with_xfercommand() function in src/pacman/conf.c file in pacman. A remote attacker can trick the victim to enable a non-default XferCommand to retrieve an attacker-controlled crafted database and package and execute arbitrary OS commands on the system with privileges of the current user.
Affected software
pacman
Arch Linux
Fedora
pacman (Alpine package)
pacman
Arch Linux
Fedora
pacman (Alpine package)
pacman
How to mitigate CVE-2019-18182
Install updates from vendor's website.
pacman - update to 5.2.0
pacman (Alpine package) - update to 5.2.0-r0
pacman - addressed in versions 5.2.1-2.fc30, 5.2.1-2.fc31, 5.2.1-2.fc32
pacman (Alpine package) - update to 5.2.0-r0
pacman - addressed in versions 5.2.1-2.fc30, 5.2.1-2.fc31, 5.2.1-2.fc32