Vulnerability · Published Aug 11, 2020 · Assigned by mitre
CVE-2020-17368
Critical 9.8
In plain English
A critical-severity security flaw in the firejail package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)4.1%top 9.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | firejail | 0.9.62-4 | DEBIAN-CVE-2020-17368 |
| Debian:13 | firejail | 0.9.62-4 | DEBIAN-CVE-2020-17368 |
| Debian:14 | firejail | 0.9.62-4 | DEBIAN-CVE-2020-17368 |
Affected products (as reported)
References
- https://github.com/netblue30/firejail/ x_refsource_MISC
- DSA-4742 vendor-advisory, x_refsource_DEBIAN
- DSA-4743 vendor-advisory, x_refsource_DEBIAN
- openSUSE-SU-2020:1208 vendor-advisory, x_refsource_SUSE
- [debian-lts-announce] 20200822 [SECURITY] [DLA 2336-1] firejail security update mailing-list, x_refsource_MLIST
- FEDORA-2020-45fc8559d5 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-80a6d7e7e0 vendor-advisory, x_refsource_FEDORA
- GLSA-202101-02 vendor-advisory, x_refsource_GENTOO