Bug 2152387 (CVE-2022-45145)

Summary:	CVE-2022-45145 chicken: arbitrary OS command execution
Product:	[Other] Security Response	Reporter:	ybuenos
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	chicken 5.3.1	Doc Type:	---
Doc Text:	An OS command injection flaw was found in chicken 5.x before 5.3.1. It is possible to inject OS commands via escape characters in a .egg file during package installation.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-12 04:47:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2152388, 2152389
Bug Blocks:

Description ybuenos 2022-12-11 12:56:37 UTC

egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.

https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=blobdiff;f=egg-compile.scm;h=9ba4568113350ec75204cba55e43e27925e2d6fe;hp=c1f2ceb0fb470f63c2ba2a1cf9d8d40083c2359f;hb=a08f8f548d772ef410c672ba33a27108d8d434f3;hpb=9c6fb001c25de4390f46ffd7c3c94237f4df92a9
https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=blobdiff;f=NEWS;h=54888afff09353093453673c407cabfe76a5ce77;hp=a3fd88a892f82c8353267f50509d018bbb1934b9;hb=670478435a982fc4d1f001ea08669f53d35a51cd;hpb=a08f8f548d772ef410c672ba33a27108d8d434f3
https://lists.gnu.org/archive/html/chicken-announce/2022-11/msg00000.html

Comment 1 ybuenos 2022-12-11 12:56:55 UTC

Created chicken tracking bugs for this issue:

Affects: epel-7 [bug 2152388]
Affects: fedora-all [bug 2152389]

Comment 2 Product Security DevOps Team 2022-12-12 04:47:57 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.