CVE-2024-38448 Command injection in n/a
Attackers can execute arbitrary code via shell metacharacters in the dbpath argument when using GNU Global with untrusted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38448?
CVE-2024-38448 is a critical command injection vulnerability in n/a, published on 16 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.
Weakness: CWE-94
Which versions are affected by CVE-2024-38448?
Linux distribution packages (5)
global SUSE:Package Hub 15 SP5 | All versions | 6.6.9-bp156.3.3.1 |
global SUSE:Package Hub 15 SP6 | All versions | 6.6.9-bp156.3.3.1 |
global openSUSE:Leap 15.5 | All versions | 6.6.9-bp156.3.3.1 |
global openSUSE:Leap 15.6 | All versions | 6.6.9-bp156.3.3.1 |
global openSUSE:Tumbleweed | All versions | 6.6.13-1.1 |
How do I fix CVE-2024-38448?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-38448 being exploited?
There is no known exploitation of CVE-2024-38448 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-38448, GHSA-j4rp-pq8q-wm7r, UBUNTU-CVE-2024-38448, openSUSE-SU-2024:0210-1, openSUSE-SU-2024:14123-1.