Описание
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
A flaw was found in gdu, a disk usage analyzer. This vulnerability occurs because gdu does not properly remove terminal escape sequences from directory and file names when displaying paths after exiting its Text-based User Interface (TUI). An attacker can craft malicious directory or file names containing these escape sequences. When a user views these names, their terminal interprets the sequences, which could lead to unauthorized title spoofing, clipboard manipulation, or other terminal-dependent effects.
Отчет
Red Hat products are not affected by this vulnerability as gdu is not shipped in any Red Hat product. Community packages in Fedora and EPEL are affected.
Меры по смягчению последствий
Avoid running gdu in directories where untrusted users can create files or subdirectories with crafted names. Pipe gdu output through a terminal escape filter to neutralize injected sequences.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5 Medium
CVSS3
Связанные уязвимости
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
gdu fails to strip terminal escape sequences from directory and file n ...
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
EPSS
5 Medium
CVSS3