CVE-2021-3726

Опубликовано: 30 нояб. 2021

Источник: nvd

CVSS3: 7.5

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Vulnerability in `title` function Description: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. Fixed in: a263cdac. Impacted areas: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function.

Ссылки

https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac
Patch
Third Party Advisory
https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:planetargon:oh_my_zsh:*:*:*:*:*:*:*:*

Версия до 2021-11-11 (исключая)

EPSS

Процентиль: 63%

0.00444

Низкий

7.5 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-8jcw-2h4x-29pq

github

около 4 лет назад

# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. **Fixed in**: [a263cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function.

EPSS

Процентиль: 63%

0.00444

Низкий

7.5 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-78