Interpretation Conflict in fish-shell - CVE-2023-49284

Vulnerability identifier: #VU83864

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-49284

CWE-ID: CWE-436

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to command substitution output can trigger shell expansion. A local user can gain access to sensitive information or cause unexpected behavior.

fish-shell
Fedora
openEuler
Anolis OS
fish
fish-debugsource
fish-debuginfo
fish-doc

Install updates from vendor's website.

fish-shell - update to 3.6.2
fish - addressed in versions 3.3.1-3, 3.3.1-5, 3.3.1-6
fish-debugsource - addressed in versions 3.3.1-3, 3.3.1-5, 3.3.1-6
fish-debuginfo - addressed in versions 3.3.1-3, 3.3.1-5, 3.3.1-6
fish - update to 3.6.0-3
fish-doc - update to 3.6.0-3
fish - update to 3.7.1-2.el9

• https://github.com/fish-shell/fish-shell/security/advisories/GHSA-2j9r-pm96-wp4f
• https://github.com/fish-shell/fish-shell/commit/09986f5563e31e2c900a606438f1d60d008f3a14

• Interpretation Conflict in fish-shell
• openEuler update for fish
• openEuler 22.03 LTS SP1 update for fish
• openEuler 22.03 LTS SP2 update for fish
• openEuler 22.03 LTS update for fish
• Fedora EPEL 9 update for fish
• Anolis OS update for fish