CVE-2018-14354 Command injection in n/a
Remote IMAP servers can execute arbitrary commands on Mutt or NeoMutt clients via backquote characters in mailbox subscription commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14354?
CVE-2018-14354 is a critical command injection vulnerability in Canonical Ubuntu Linux, published on 17 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.
Weakness: CWE-78
Which versions are affected by CVE-2018-14354?
It affects 10 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Mutt Mutt, Neomutt Neomutt, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 4 more.
How do I fix CVE-2018-14354?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-14354 being exploited?
There is no known exploitation of CVE-2018-14354 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-14354, DEBIAN-CVE-2018-14354, GHSA-5hcq-hmph-mw8w, UBUNTU-CVE-2018-14354.