Bug 2293958 (CVE-2024-33869)

Summary:	CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ghostscript 10.03.1	Doc Type:	---
Doc Text:	A flaw was found in Ghostscript. In certain circumstances, path reduction in the "gp_validate_path_len" function may allow path traversal or possible command execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2296285
Bug Blocks:	2278776

Description Robb Gatica 2024-06-24 15:54:34 UTC

The function "gp_validate_path_len" first tests if the path has a cwd prefix and then reduces the path.

In the case of a path like "./../tmp/aa" it will first see that it has a cwd prefix and then reduce it to "../tmp/aa". When validation fails, it tries the variant without the cwd prefix by skipping the first two characters. But this will skip the ".." and validate "/tmp/aa", which is an allowed path (on Linux).

References:
https://ghostscript.readthedocs.io/en/gs10.03.1/News.html
https://bugs.ghostscript.com/show_bug.cgi?id=707691

Upstream commits:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f5336e5b4154f515ac83bc5b9eba94302e6618d4

Comment 2 errata-xmlrpc 2024-09-03 10:24:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:6197 https://access.redhat.com/errata/RHSA-2024:6197

Comment 3 errata-xmlrpc 2024-09-09 01:31:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:6466 https://access.redhat.com/errata/RHSA-2024:6466