CVE-2023-22643 libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls
Attackers can execute arbitrary code as root by tricking users into using specially crafted repository settings in the libzypp-plugin-appdata package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-22643?
CVE-2023-22643 is a medium-severity command injection vulnerability in SUSE Linux Enterprise Server for SAP 15-SP3, published on 7 Feb 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially crafted REPO_ALIAS, REPO_TYPE or REPO_METADATA_PATH settings to execute code as root. This issue affects: SUSE Linux Enterprise Server for SAP 15-SP3 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. openSUSE Leap 15.4 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426.
Weakness: CWE-78
Which versions are affected by CVE-2023-22643?
It affects 1 product.
Linux distribution packages (17)
libzypp-plugin-appdata SUSE:Enterprise Storage 6 | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Enterprise Storage 7 | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Enterprise Storage 7.1 | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise Module for Desktop Applications 15 SP4 | All versions | 1.0.1+git.20180426-150400.18.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 1.0.1+git.20180426-150400.18.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 1.0.1+git.20180426-150100.8.3.1 |
libzypp-plugin-appdata openSUSE:Leap 15.4 | All versions | 1.0.1+git.20180426-150400.18.3.1 |
Products include Opensuse Libzypp-Plugin-Appdata.
How do I fix CVE-2023-22643?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-22643 being exploited?
There is no known exploitation of CVE-2023-22643 in the wild and no public exploit code.
Sources
Also known as GHSA-7mcm-wrpj-6fwv, SUSE-SU-2023:0095-1, SUSE-SU-2023:0140-1, openSUSE-SU-2024:12626-1.