CVE-2026-46483 vim: command injection in tar plugin
Resolves: RHEL-178242
This commit is contained in:
Zdenek Dohnal
parent
6f2fb33b27
commit
5ba4711ff3
@ -0,0 +1,91 @@
|
||||
From a51ca3f97ec9362366c918d37905b3a083eff82e Mon Sep 17 00:00:00 2001
|
||||
From: Christian Brabandt <cb@256bit.org>
|
||||
Date: Thu, 14 May 2026 15:35:28 +0000
|
||||
Subject: [PATCH] patch 9.2.0479: [security]: runtime(tar): command injection
|
||||
in tar plugin
|
||||
|
||||
Problem: [security]: runtime(tar): command injection in tar plugin
|
||||
(Christopher Lusk)
|
||||
Solution: Use the correct shellescape(args, 1) form for a :! command
|
||||
|
||||
Github Advisory:
|
||||
https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w
|
||||
|
||||
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||
---
|
||||
runtime/autoload/tar.vim | 4 ++--
|
||||
src/testdir/Make_all.mak | 2 ++
|
||||
src/testdir/test_plugin_tar.vim | 24 ++++++++++++++++++++++++
|
||||
3 files changed, 28 insertions(+), 2 deletions(-)
|
||||
create mode 100644 src/testdir/test_plugin_tar.vim
|
||||
|
||||
diff --git a/runtime/autoload/tar.vim b/runtime/autoload/tar.vim
|
||||
index 13df5790a..ef7b21499 100644
|
||||
--- a/runtime/autoload/tar.vim
|
||||
+++ b/runtime/autoload/tar.vim
|
||||
@@ -774,9 +774,9 @@ fun! tar#Vimuntar(...)
|
||||
" if necessary, decompress the tarball; then, extract it
|
||||
if tartail =~ '\.tgz'
|
||||
if executable("gunzip")
|
||||
- silent exe "!gunzip ".shellescape(tartail)
|
||||
+ silent exe "!gunzip ".shellescape(tartail, 1)
|
||||
elseif executable("gzip")
|
||||
- silent exe "!gzip -d ".shellescape(tartail)
|
||||
+ silent exe "!gzip -d ".shellescape(tartail, 1)
|
||||
else
|
||||
echoerr "unable to decompress<".tartail."> on this sytem"
|
||||
if simplify(curdir) != simplify(tarhome)
|
||||
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
|
||||
index 111111111..222222222 100644
|
||||
--- a/src/testdir/Make_all.mak
|
||||
+++ b/src/testdir/Make_all.mak
|
||||
@@ -209,6 +209,7 @@ NEW_TESTS = \
|
||||
test_paste \
|
||||
test_perl \
|
||||
+ test_plugin_tar \
|
||||
test_plus_arg_edit \
|
||||
test_popup \
|
||||
test_popupwin \
|
||||
test_popupwin_textprop \
|
||||
@@ -447,6 +448,7 @@ NEW_TESTS_RES = \
|
||||
test_paste.res \
|
||||
test_perl.res \
|
||||
+ test_plugin_tar.res \
|
||||
test_plus_arg_edit.res \
|
||||
test_popup.res \
|
||||
test_popupwin.res \
|
||||
test_popupwin_textprop.res \
|
||||
diff --git a/src/testdir/test_plugin_tar.vim b/src/testdir/test_plugin_tar.vim
|
||||
new file mode 100644
|
||||
index 000000000..000000001
|
||||
--- /dev/null
|
||||
+++ b/src/testdir/test_plugin_tar.vim
|
||||
@@ -0,0 +1,25 @@
|
||||
+vim9script
|
||||
+
|
||||
+source check.vim
|
||||
+CheckNotMSWindows
|
||||
+
|
||||
+runtime plugin/tarPlugin.vim
|
||||
+
|
||||
+def g:Test_extract_command_injection()
|
||||
+ CheckExecutable gunzip
|
||||
+ CheckExecutable touch
|
||||
+ var tgz = eval('0z1F8B08087795056A000364756D6D792E74617200EDCE2B12C2300004D01C254' ..
|
||||
+ '7480269CE534080A8495BD1DBF3996106C3A08A7ACFACD8157B59A7690BFB4A0FC3707C666E357D' ..
|
||||
+ 'E65BC8B5A47CC8A5D61A522EA5B510D3CEBF5ED679197B8CE17CEDB7F9D4C76FBB5F3D000000000' ..
|
||||
+ '000000000FCD11D32415E2C00280000')
|
||||
+ var dirname = tempname()
|
||||
+
|
||||
+ mkdir(dirname, 'R')
|
||||
+ var tar = dirname .. "/';%$(touch pwned)'.tgz"
|
||||
+ writefile(tgz, tar)
|
||||
+ new
|
||||
+ exe "e " .. fnameescape(tar)
|
||||
+ exe ":Vimuntar " .. dirname
|
||||
+ assert_false(filereadable(dirname .. "/pwned"))
|
||||
+ bw!
|
||||
+enddef
|
||||
--
|
||||
2.52.0
|
||||
|
||||
10
vim.spec
10
vim.spec
@ -27,7 +27,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 31%{?dist}
|
||||
Release: 32%{?dist}
|
||||
License: Vim and MIT
|
||||
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
|
||||
Source1: virc
|
||||
@ -198,6 +198,10 @@ Patch3069: 0001-patch-9.2.0357-security-command-injection-via-backti.patch
|
||||
# https://github.com/vim/vim/commit/8c8772c6b321d4955c8f09926e3eda2b4cd83680
|
||||
Patch3070: 0001-patch-9.2.0276-security-modeline-security-bypass.patch
|
||||
Patch3071: 0001-patch-9.2.0277-tests-test_modeline.vim-fails.patch
|
||||
# RHEL-178242 CVE-2026-46483 runtime(tar): command injection in tar plugin
|
||||
# https://redhat.atlassian.net/browse/RHEL-178242
|
||||
# https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1
|
||||
Patch3072: 0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch
|
||||
|
||||
|
||||
# gcc is no longer in buildroot by default
|
||||
@ -457,6 +461,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3069 -p1 -b .tag-backtick-inject
|
||||
%patch -P 3070 -p1 -b .modeline-bypass
|
||||
%patch -P 3071 -p1 -b .modeline-tests
|
||||
%patch -P 3072 -p1 -b .tar-cmd-inject
|
||||
|
||||
%build
|
||||
cd src
|
||||
@ -1009,6 +1014,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Thu Jul 16 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-32
|
||||
- RHEL-178242 CVE-2026-46483 vim: command injection in tar plugin
|
||||
|
||||
* Wed May 27 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-31
|
||||
- CVE-2026-34982 vim: arbitrary command execution via modeline sandbox bypass
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user