USN-5367-1: fish vulnerability
10 August 2022
fish could be made to run programs if it read data from a specially crafted file.
Releases
Packages
- fish - friendly interactive shell
Details
Justin Steven discovered that fish was not properly filtering local
git configuration directives when running background git commands.
A remote unauthenticated attacker could possibly use this issue to
execute arbitrary code.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04
-
fish
-
3.3.1+ds-3ubuntu0.1~esm1
Available with Ubuntu Pro
-
fish-common
-
3.3.1+ds-3ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04
-
fish
-
3.1.0-1.2ubuntu0.1~esm1
Available with Ubuntu Pro
-
fish-common
-
3.1.0-1.2ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.