OS Command Injection in zsh - CVE-2021-45444

Vulnerability identifier: #VU60674

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-45444

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to recursive PROMPT_SUBST expansion when processing malicious output. A remote attacker with ability to control the output can inject and execute arbitrary commands on the system with privileges on the current user.

zsh
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
HPE Helion Openstack
Anolis OS
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
macOS
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
Fedora
zsh (Debian package)
zsh-static (Ubuntu package)
zsh (Ubuntu package)
zsh
zsh-debuginfo
zsh-debugsource
zsh-html
zsh (Red Hat package)
zsh-help
app-shells/zsh

Install updates from vendor's website.

zsh - update to 5.8.1
zsh (Debian package) - addressed in versions 5.7.1-1+deb10u1, 5.8-6+deb11u1
macOS - addressed in versions 10.15.7 19H1922, 11.6.6 20G624, 12.4 21F79
zsh-static (Ubuntu package) - addressed in versions UA Infra or UA Desktop, 5.4.2-3ubuntu3.2, 5.8-3ubuntu1.1, 5.8-6ubuntu0.1
zsh (Ubuntu package) - addressed in versions UA Infra or UA Desktop, 5.4.2-3ubuntu3.2, 5.8-3ubuntu1.1, 5.8-6ubuntu0.1
zsh - addressed in versions 5.0.5-6.19.1, 5.6-3.11.1, 5.6-7.5.1
zsh-debuginfo - addressed in versions 5.0.5-6.19.1, 5.6-3.11.1, 5.6-7.5.1
zsh-debugsource - addressed in versions 5.0.5-6.19.1, 5.6-3.11.1, 5.6-7.5.1
zsh-html - update to 5.5.1-9
zsh - update to 5.5.1-9
zsh (Red Hat package) - update to 5.5.1-9.el8
zsh-help - addressed in versions 5.7.1-6, 5.8-3
zsh-debuginfo - addressed in versions 5.7.1-6, 5.8-3
zsh-debugsource - addressed in versions 5.7.1-6, 5.8-3
zsh - addressed in versions 5.7.1-6, 5.8-3
app-shells/zsh - update to 5.8.1
zsh - update to 5.8.1-1
zsh - addressed in versions 5.8.1-1.fc34, 5.8.1-1.fc35
zsh - update to 5.9

• https://zsh.sourceforge.io/releases.html
• https://vuln.ryotak.me/advisories/63
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P3LPMGENEHKDWFO4MWMZSZL6G7Y4CV7/
• https://www.debian.org/security/2022/dsa-5078

• Remote command execution in zsh
• Debian update for zsh
• Ubuntu update for zsh
• Red Hat Enterprise Linux 8 update for zsh
• Multiple vulnerabilities in Apple macOS Monterey
• Multiple vulnerabilities in Apple macOS Big Sur
• Multiple vulnerabilities in Apple macOS Catalina
• SUSE update for zsh
• SUSE update for zsh
• SUSE update for zsh
• openEuler update for zsh
• openEuler 22.03 LTS update for zsh
• Gentoo update for Zsh
• Amazon Linux AMI update for zsh
• Fedora 35 update for zsh
• Fedora 34 update for zsh
• Anolis OS update for zsh
• Slackware Linux update for zsh