OS Command Injection in pacman - CVE-2019-18183
Published: October 23, 2019
Vulnerability identifier: #VU22198
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-18183
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within the the apply_deltas() function in lib/libalpm/sync.c file in pacman. A remote attacker can trick the victim to enable a non-default delta feature, retrieve an attacker-controlled crafted database and package and execute arbitrary OS commands on the system with privileges of the current user.
Affected software
pacman
Arch Linux
Fedora
pacman (Alpine package)
pacman
Arch Linux
Fedora
pacman (Alpine package)
pacman
How to mitigate CVE-2019-18183
Install updates from vendor's website.
pacman - update to 5.2.0
pacman (Alpine package) - update to 5.2.0-r0
pacman - addressed in versions 5.2.1-2.fc30, 5.2.1-2.fc31, 5.2.1-2.fc32
pacman (Alpine package) - update to 5.2.0-r0
pacman - addressed in versions 5.2.1-2.fc30, 5.2.1-2.fc31, 5.2.1-2.fc32