Vulnerability · Published Mar 14, 2022 · Assigned by GitHub_M
CVE-2022-20001Injection in fish
High 7.8
In plain English
A high-severity injection in fish-shell from fish-shell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs `git` commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the `fish_git_prompt` function from the prompt.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | fish | 3.4.0-r0 | ALPINE-CVE-2022-20001 |
| Alpine:v3.21 | fish | 3.4.0-r0 | ALPINE-CVE-2022-20001 |
| Alpine:v3.22 | fish | 3.4.0-r0 | ALPINE-CVE-2022-20001 |
| Alpine:v3.23 | fish | 3.4.0-r0 | ALPINE-CVE-2022-20001 |
| Alpine:v3.24 | fish | 3.4.0-r0 | ALPINE-CVE-2022-20001 |
| Debian:12 | fish | 3.4.0+ds-1 | DEBIAN-CVE-2022-20001 |
| Debian:13 | fish | 3.4.0+ds-1 | DEBIAN-CVE-2022-20001 |
| Debian:14 | fish | 3.4.0+ds-1 | DEBIAN-CVE-2022-20001 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fish-shell | fish-shell | >= 3.1.0, < 3.4.0 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mq
- https://github.com/fish-shell/fish-shell/pull/8589
- https://github.com/fish-shell/fish-shell/releases/tag/3.4.0
- FEDORA-2022-443c5ec2dd vendor-advisory
- FEDORA-2022-cd2c5e0634 vendor-advisory
- DSA-5234 vendor-advisory
- GLSA-202309-10 vendor-advisory