Resolves: CVE-2021-45444 - do not perform PROMPT_SUBST evaluation on %F/%K arguments

0002-zsh-5.8-CVE-2021-45444.patch

@@ -0,0 +1,109 @@
+From 02e0f94fff27cad2ba4e65bdc4b21146b3bd9a97 Mon Sep 17 00:00:00 2001
+From: Oliver Kiddle <opk@zsh.org>
+Date: Wed, 15 Dec 2021 01:56:40 +0100
+Subject: [PATCH 1/2] security/41: Don't perform PROMPT_SUBST evaluation on
+ %F/%K arguments
+
+Mitigates CVE-2021-45444
+
+Upstream-commit: c187154f47697cdbf822c2f9d714d570ed4a0fd1
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ Src/prompt.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/Src/prompt.c b/Src/prompt.c
+index b65bfb8..91e21c8 100644
+--- a/Src/prompt.c
++++ b/Src/prompt.c
+@@ -244,6 +244,12 @@ parsecolorchar(zattr arg, int is_fg)
+ 	bv->fm += 2; /* skip over F{ */
+ 	if ((ep = strchr(bv->fm, '}'))) {
+ 	    char oc = *ep, *col, *coll;
++	    int ops = opts[PROMPTSUBST], opb = opts[PROMPTBANG];
++	    int opp = opts[PROMPTPERCENT];
++
++	    opts[PROMPTPERCENT] = 1;
++	    opts[PROMPTSUBST] = opts[PROMPTBANG] = 0;
++
+ 	    *ep = '\0';
+ 	    /* expand the contents of the argument so you can use
+ 	     * %v for example */
+@@ -252,6 +258,10 @@ parsecolorchar(zattr arg, int is_fg)
+ 	    arg = match_colour((const char **)&coll, is_fg, 0);
+ 	    free(col);
+ 	    bv->fm = ep;
++
++	    opts[PROMPTSUBST] = ops;
++	    opts[PROMPTBANG] = opb;
++	    opts[PROMPTPERCENT] = opp;
+ 	} else {
+ 	    arg = match_colour((const char **)&bv->fm, is_fg, 0);
+ 	    if (*bv->fm != '}')
+-- 
+2.34.1
+
+
+From 6102afb5dfd7c704f9cf99bedb9c3ec3c7dbe8e3 Mon Sep 17 00:00:00 2001
+From: dana <dana@dana.is>
+Date: Tue, 21 Dec 2021 13:13:33 -0600
+Subject: [PATCH 2/2] CVE-2021-45444: Update NEWS/README
+
+Upstream-commit: bdc4d70a7e033b754e68a8659a037ea0fc5f38de
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ NEWS   | 20 ++++++++++++++++++++
+ README |  6 ++++++
+ 2 files changed, 26 insertions(+)
+
+diff --git a/NEWS b/NEWS
+index 964e163..327b449 100644
+--- a/NEWS
++++ b/NEWS
+@@ -4,6 +4,26 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH
+ 
+ Note also the list of incompatibilities in the README file.
+ 
++Changes since 5.8
++-----------------
++
++CVE-2021-45444: Some prompt expansion sequences, such as %F, support
++'arguments' which are themselves expanded in case they contain colour
++values, etc. This additional expansion would trigger PROMPT_SUBST
++evaluation, if enabled. This could be abused to execute code the user
++didn't expect. e.g., given a certain prompt configuration, an attacker
++could trick a user into executing arbitrary code by having them check
++out a Git branch with a specially crafted name.
++
++This is fixed in the shell itself by no longer performing PROMPT_SUBST
++evaluation on these prompt-expansion arguments.
++
++Users who are concerned about an exploit but unable to update their
++binaries may apply the partial work-around described in the file
++Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell
++source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to
++Marc Cornellà <hello@mcornella.com>. ]
++
+ Changes since 5.7.1-test-3
+ --------------------------
+ 
+diff --git a/README b/README
+index 7f1dd5f..c9e994a 100644
+--- a/README
++++ b/README
+@@ -31,6 +31,12 @@ Zsh is a shell with lots of features.  For a list of some of these, see the
+ file FEATURES, and for the latest changes see NEWS.  For more
+ details, see the documentation.
+ 
++Incompatibilities since 5.8
++---------------------------
++
++PROMPT_SUBST expansion is no longer performed on arguments to prompt-
++expansion sequences such as %F.
++
+ Incompatibilities since 5.7.1
+ -----------------------------
+ 
+-- 
+2.34.1
+

zsh.spec

@@ -1,7 +1,7 @@
 Summary: Powerful interactive shell
 Name: zsh
 Version: 5.8
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: MIT
 URL: http://zsh.sourceforge.net/
 Source0: https://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.xz
@@ -15,6 +15,9 @@ Source6: dotzshrc
 # complete file arguments after rpmbuild -r/-b/-t
 Patch1:  0001-zsh-5.8-comp-rpm.patch
 
+# do not perform PROMPT_SUBST evaluation on %F/%K arguments (CVE-2021-45444)
+Patch2:  0002-zsh-5.8-CVE-2021-45444.patch
+
 BuildRequires: autoconf
 BuildRequires: coreutils
 BuildRequires: gawk
@@ -158,6 +161,9 @@ fi
 %doc Doc/*.html
 
 %changelog
+* Tue Feb 22 2022 Kamil Dudka <kdudka@redhat.com> - 5.8-9
+- do not perform PROMPT_SUBST evaluation on %F/%K arguments (CVE-2021-45444)
+
 * Thu Nov 25 2021 Debarshi Ray <rishi@fedoraproject.org> - 5.8-8
 - Overwrite PROMPT only if it's set to the built-in default (#2026749)