CVE-2021-40084 Command injection in n/a
opensysusers allows command execution via shell metacharacters in GECOS fields due to unsafe eval usage, requiring a patch to prevent privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-40084?
CVE-2021-40084 is a critical command injection vulnerability in n/a, published on 25 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
Weakness: CWE-94
Which versions are affected by CVE-2021-40084?
It affects 1 product.
Products include Artixlinux Opensysusers.
How do I fix CVE-2021-40084?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-40084 being exploited?
There is no known exploitation of CVE-2021-40084 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2021-40084, GHSA-2hgh-26fm-566h, UBUNTU-CVE-2021-40084.