diff --git a/SOURCES/0002-zsh-5.8-CVE-2021-45444.patch b/SOURCES/0002-zsh-5.8-CVE-2021-45444.patch new file mode 100644 index 0000000..4f4fdbb --- /dev/null +++ b/SOURCES/0002-zsh-5.8-CVE-2021-45444.patch @@ -0,0 +1,109 @@ +From 02e0f94fff27cad2ba4e65bdc4b21146b3bd9a97 Mon Sep 17 00:00:00 2001 +From: Oliver Kiddle +Date: Wed, 15 Dec 2021 01:56:40 +0100 +Subject: [PATCH 1/2] security/41: Don't perform PROMPT_SUBST evaluation on + %F/%K arguments + +Mitigates CVE-2021-45444 + +Upstream-commit: c187154f47697cdbf822c2f9d714d570ed4a0fd1 +Signed-off-by: Kamil Dudka +--- + Src/prompt.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/Src/prompt.c b/Src/prompt.c +index b65bfb8..91e21c8 100644 +--- a/Src/prompt.c ++++ b/Src/prompt.c +@@ -244,6 +244,12 @@ parsecolorchar(zattr arg, int is_fg) + bv->fm += 2; /* skip over F{ */ + if ((ep = strchr(bv->fm, '}'))) { + char oc = *ep, *col, *coll; ++ int ops = opts[PROMPTSUBST], opb = opts[PROMPTBANG]; ++ int opp = opts[PROMPTPERCENT]; ++ ++ opts[PROMPTPERCENT] = 1; ++ opts[PROMPTSUBST] = opts[PROMPTBANG] = 0; ++ + *ep = '\0'; + /* expand the contents of the argument so you can use + * %v for example */ +@@ -252,6 +258,10 @@ parsecolorchar(zattr arg, int is_fg) + arg = match_colour((const char **)&coll, is_fg, 0); + free(col); + bv->fm = ep; ++ ++ opts[PROMPTSUBST] = ops; ++ opts[PROMPTBANG] = opb; ++ opts[PROMPTPERCENT] = opp; + } else { + arg = match_colour((const char **)&bv->fm, is_fg, 0); + if (*bv->fm != '}') +-- +2.34.1 + + +From 6102afb5dfd7c704f9cf99bedb9c3ec3c7dbe8e3 Mon Sep 17 00:00:00 2001 +From: dana +Date: Tue, 21 Dec 2021 13:13:33 -0600 +Subject: [PATCH 2/2] CVE-2021-45444: Update NEWS/README + +Upstream-commit: bdc4d70a7e033b754e68a8659a037ea0fc5f38de +Signed-off-by: Kamil Dudka +--- + NEWS | 20 ++++++++++++++++++++ + README | 6 ++++++ + 2 files changed, 26 insertions(+) + +diff --git a/NEWS b/NEWS +index 964e163..327b449 100644 +--- a/NEWS ++++ b/NEWS +@@ -4,6 +4,26 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH + + Note also the list of incompatibilities in the README file. + ++Changes since 5.8 ++----------------- ++ ++CVE-2021-45444: Some prompt expansion sequences, such as %F, support ++'arguments' which are themselves expanded in case they contain colour ++values, etc. This additional expansion would trigger PROMPT_SUBST ++evaluation, if enabled. This could be abused to execute code the user ++didn't expect. e.g., given a certain prompt configuration, an attacker ++could trick a user into executing arbitrary code by having them check ++out a Git branch with a specially crafted name. ++ ++This is fixed in the shell itself by no longer performing PROMPT_SUBST ++evaluation on these prompt-expansion arguments. ++ ++Users who are concerned about an exploit but unable to update their ++binaries may apply the partial work-around described in the file ++Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell ++source. [ Reported by RyotaK . Additional thanks to ++Marc Cornellà . ] ++ + Changes since 5.7.1-test-3 + -------------------------- + +diff --git a/README b/README +index 7f1dd5f..c9e994a 100644 +--- a/README ++++ b/README +@@ -31,6 +31,12 @@ Zsh is a shell with lots of features. For a list of some of these, see the + file FEATURES, and for the latest changes see NEWS. For more + details, see the documentation. + ++Incompatibilities since 5.8 ++--------------------------- ++ ++PROMPT_SUBST expansion is no longer performed on arguments to prompt- ++expansion sequences such as %F. ++ + Incompatibilities since 5.7.1 + ----------------------------- + +-- +2.34.1 + diff --git a/SOURCES/zshrc.rhs b/SOURCES/zshrc.rhs index 5b3b92a..82dc213 100644 --- a/SOURCES/zshrc.rhs +++ b/SOURCES/zshrc.rhs @@ -8,7 +8,7 @@ #setenv() { export $1=$2 } # csh compatibility # Set prompts -PROMPT='[%n@%m]%~%# ' # default prompt +[[ "$PROMPT" = "%m%# " ]] && PROMPT='[%n@%m]%~%# ' # default prompt #RPROMPT=' %~' # prompt for right side of screen # bindkey -v # vi key bindings diff --git a/SPECS/zsh.spec b/SPECS/zsh.spec index 2a1d521..e4a2f10 100644 --- a/SPECS/zsh.spec +++ b/SPECS/zsh.spec @@ -1,7 +1,7 @@ Summary: Powerful interactive shell Name: zsh Version: 5.8 -Release: 7%{?dist} +Release: 9%{?dist} License: MIT URL: http://zsh.sourceforge.net/ Source0: https://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.xz @@ -15,6 +15,9 @@ Source6: dotzshrc # complete file arguments after rpmbuild -r/-b/-t Patch1: 0001-zsh-5.8-comp-rpm.patch +# do not perform PROMPT_SUBST evaluation on %F/%K arguments (CVE-2021-45444) +Patch2: 0002-zsh-5.8-CVE-2021-45444.patch + BuildRequires: autoconf BuildRequires: coreutils BuildRequires: gawk @@ -158,6 +161,12 @@ fi %doc Doc/*.html %changelog +* Tue Feb 22 2022 Kamil Dudka - 5.8-9 +- do not perform PROMPT_SUBST evaluation on %F/%K arguments (CVE-2021-45444) + +* Thu Nov 25 2021 Debarshi Ray - 5.8-8 +- Overwrite PROMPT only if it's set to the built-in default (#2026749) + * Tue Aug 10 2021 Mohan Boddu - 5.8-7 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688