| Summary: |
CVE-2025-47906 os/exec: Unexpected paths returned from LookPath in os/exec |
| Product: |
[Other] Security Response
|
Reporter: |
OSIDB Bzimport <bzimport> |
| Component: |
vulnerability | Assignee: |
Product Security DevOps Team <prodsec-dev> |
| Status: |
NEW
---
|
QA Contact: |
|
| Severity: |
medium
|
Docs Contact: |
|
| Priority: |
medium
|
|
|
| Version: |
unspecified | CC: |
aazores, abarbaro, abrianik, adistefa, akostadi, akoudelk, alcohan, amasferr, amctagga, anjoseph, anpicker, ansmith, aoconnor, asatyam, ataylor, bdettelb, bkabrda, bniver, bparees, brainfor, cbartlet, chfoley, ckandaga, cmah, crizzo, debarshir, dhanak, diagrawa, dmayorov, doconnor, drosa, dsimansk, dymurray, eaguilar, ebaron, eglynn, fdeutsch, flucifre, ggrzybek, gmeno, gparvin, haoli, hasun, hkataria, ibolton, jaharrin, jajackso, jbalunas, jburrell, jcammara, jcantril, jchui, jeder, jfula, jhe, jjoyce, jkoehler, jlledo, jmatthew, jmitchel, jmontleo, jneedle, jolong, jowilson, jprabhak, jschluet, kegrant, kingland, koliveir, kshier, ktsao, kverlaen, lball, lbragsta, lchilton, ldai, lgamliel, lhh, lphiri, lsharar, lsvaty, lucarval, mabashia, manissin, matzew, mbenjamin, mbocek, mburns, mgarciac, mhackett, mkudlej, mmakovy, mnovotny, mwringe, nboldt, ngough, nyancey, ometelka, oramraz, owatkins, pahickey, parichar, pbraun, peholase, pgaikwad, pgrist, pjindal, psrna, ptisnovs, pvasanth, rfreiman, rhaigner, rjohnson, rojacob, sabiswas, sakbas, sausingh, sdawley, sfeifer, shvarugh, simaishi, slucidi, smcdonal, smullick, sostapov, sseago, stcannon, stirabos, swoodman, syedriko, tasato, teagle, tfister, thason, thavo, tjochec, vereddy, veshanka, wenshen, whayutin, wtam, xdharmai, xiyuan, yguenane
|
| Target Milestone: |
--- | Keywords: |
Security |
| Target Release: |
--- | |
|
| Hardware: |
All | |
|
| OS: |
Linux | |
|
| Whiteboard: |
|
|
Fixed In Version:
|
|
Doc Type:
|
---
|
|---|
|
Doc Text:
|
A path handling flaw has been discovered in the os/exec go package. If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
|
Story Points:
|
---
|
|---|
|
Clone Of:
|
|
Environment:
|
|
|---|
|
Last Closed:
|
|
Type:
|
---
|
|---|
|
Regression:
|
---
|
Mount Type:
|
---
|
|---|
|
Documentation:
|
---
|
CRM:
|
|
|---|
|
Verified Versions:
|
|
Category:
|
---
|
|---|
|
oVirt Team:
|
---
|
RHEL 7.3 requirements from Atomic Host:
|
|
|---|
|
Cloudforms Team:
|
---
|
Target Upstream Version:
|
|
|---|
|
Embargoed:
|
|
| |
|---|
| Bug Depends On: |
2398915, 2398916, 2398917, 2398918, 2398921, 2398922, 2398923, 2398924, 2398925, 2398926, 2398927, 2398928, 2398929, 2398930, 2398931, 2398932, 2398933, 2398934, 2398935, 2398936, 2398939, 2398940, 2398945, 2398950, 2398951, 2398952, 2398953, 2398954, 2398957, 2398958, 2398959, 2398960, 2398961, 2398962, 2398963, 2398966, 2398967, 2398968, 2398969, 2398970, 2398972, 2398973, 2398974, 2398975, 2398980, 2398982, 2398983, 2398985, 2398986, 2398987, 2398990, 2398991, 2398992, 2398994, 2398995, 2398996, 2398997, 2398998, 2398999, 2399000, 2399001, 2399002, 2399003, 2399004, 2399005, 2399006, 2399007, 2399008, 2399009, 2399010, 2399013, 2399014, 2399015, 2399020, 2399022, 2399023, 2399026, 2399027, 2399028, 2399029, 2399031, 2399032, 2399033, 2399034, 2399310, 2399311, 2399313, 2399314, 2399317, 2399320, 2399322, 2399323, 2399325, 2399326, 2399327, 2399328, 2399334, 2399335, 2399336, 2399341, 2399342, 2399343, 2399344, 2399345, 2399346, 2399347, 2399348, 2399349, 2399351, 2399352, 2399353, 2399356, 2399359, 2399360, 2399361, 2399362, 2399364, 2399365, 2399369, 2399370, 2399371, 2399373, 2399375, 2399376, 2399377, 2399378, 2399379, 2399380, 2399381, 2399382, 2399383, 2399384, 2399385, 2399386, 2399387, 2399388, 2399389, 2399390, 2399391, 2399392, 2399393, 2399394, 2399395, 2399396, 2399397, 2399398, 2399399, 2399400, 2399401, 2399402, 2399403, 2399404, 2399406, 2399407, 2399408, 2399409, 2399410, 2399411, 2399412, 2399413, 2399414, 2399415, 2399417, 2399419, 2399420, 2399421, 2399422, 2399423, 2399424, 2399425, 2399426, 2399427, 2399428, 2399429, 2399430, 2399431, 2399432, 2399433, 2399434, 2399435, 2399436, 2399437, 2399438, 2399439, 2399440, 2399441, 2399442, 2399443, 2399444, 2399445, 2399447, 2399448, 2399449, 2399450, 2399451, 2399452, 2399453, 2399454, 2399455, 2399456, 2399457, 2399458, 2399459, 2399460, 2399461, 2399462, 2399463, 2399464, 2399465, 2399466, 2399467, 2399468, 2399469, 2399470, 2399471, 2399472, 2399473, 2399474, 2399475, 2399476, 2399477, 2399478, 2399479, 2399480, 2399481, 2399482, 2399483, 2399484, 2399485, 2399486, 2399487, 2399488, 2399490, 2399491, 2399492, 2399493, 2399494, 2399495, 2399496, 2399497, 2399499, 2399500, 2399501, 2399503, 2399504, 2399506, 2399507, 2399509, 2399511, 2399512, 2399513, 2399515, 2399516, 2399517, 2399519, 2399520, 2399526, 2399527, 2399528, 2399529, 2399530, 2399532, 2399534, 2399535, 2399536, 2399538, 2399539, 2399540, 2399541, 2399542, 2399544, 2399545, 2399547, 2399548, 2399553, 2399555, 2399557, 2399559, 2399560, 2399564, 2399567, 2399568, 2399570, 2399571, 2399572, 2399573, 2399574, 2399576, 2399580, 2399581, 2399583, 2399584, 2399585, 2399586, 2399587, 2399588, 2396348, 2398913, 2398914, 2398919, 2398920, 2398937, 2398938, 2398941, 2398942, 2398943, 2398944, 2398946, 2398947, 2398948, 2398949, 2398955, 2398956, 2398964, 2398965, 2398971, 2398976, 2398977, 2398978, 2398979, 2398981, 2398984, 2398988, 2398989, 2398993, 2399011, 2399012, 2399016, 2399017, 2399018, 2399019, 2399021, 2399024, 2399025, 2399030, 2399035, 2399036, 2399037, 2399038, 2399039, 2399040, 2399041, 2399042, 2399043, 2399044, 2399045, 2399046, 2399047, 2399048, 2399049, 2399050, 2399051, 2399052, 2399053, 2399054, 2399055, 2399056, 2399057, 2399058, 2399059, 2399060, 2399061, 2399062, 2399063, 2399064, 2399065, 2399066, 2399067, 2399068, 2399069, 2399070, 2399071, 2399072, 2399073, 2399074, 2399075, 2399076, 2399077, 2399078, 2399079, 2399080, 2399081, 2399082, 2399083, 2399084, 2399085, 2399086, 2399087, 2399088, 2399089, 2399090, 2399091, 2399092, 2399093, 2399094, 2399095, 2399096, 2399097, 2399098, 2399099, 2399100, 2399101, 2399102, 2399103, 2399104, 2399105, 2399106, 2399107, 2399108, 2399109, 2399110, 2399111, 2399112, 2399113, 2399114, 2399115, 2399116, 2399117, 2399118, 2399119, 2399120, 2399121, 2399122, 2399123, 2399124, 2399125, 2399126, 2399127, 2399128, 2399129, 2399130, 2399131, 2399132, 2399133, 2399134, 2399135, 2399136, 2399137, 2399138, 2399140, 2399142, 2399143, 2399144, 2399145, 2399146, 2399147, 2399148, 2399149, 2399150, 2399151, 2399152, 2399153, 2399154, 2399155, 2399156, 2399157, 2399158, 2399159, 2399160, 2399161, 2399162, 2399163, 2399164, 2399165, 2399166, 2399167, 2399168, 2399169, 2399170, 2399171, 2399172, 2399173, 2399174, 2399175, 2399176, 2399177, 2399178, 2399179, 2399180, 2399181, 2399182, 2399183, 2399184, 2399185, 2399186, 2399187, 2399188, 2399189, 2399190, 2399191, 2399192, 2399193, 2399194, 2399195, 2399196, 2399197, 2399198, 2399199, 2399200, 2399201, 2399202, 2399203, 2399204, 2399205, 2399206, 2399207, 2399208, 2399209, 2399210, 2399211, 2399212, 2399213, 2399214, 2399215, 2399216, 2399217, 2399218, 2399219, 2399220, 2399221, 2399222, 2399223, 2399224, 2399225, 2399226, 2399227, 2399228, 2399229, 2399230, 2399231, 2399232, 2399233, 2399234, 2399235, 2399236, 2399237, 2399238, 2399239, 2399240, 2399241, 2399242, 2399243, 2399244, 2399245, 2399246, 2399247, 2399248, 2399249, 2399250, 2399251, 2399252, 2399253, 2399254, 2399255, 2399256, 2399257, 2399258, 2399259, 2399260, 2399261, 2399262, 2399263, 2399264, 2399265, 2399266, 2399267, 2399268, 2399269, 2399270, 2399271, 2399272, 2399273, 2399274, 2399275, 2399276, 2399277, 2399278, 2399279, 2399280, 2399281, 2399282, 2399283, 2399284, 2399285, 2399286, 2399287, 2399288, 2399289, 2399290, 2399291, 2399292, 2399293, 2399294, 2399295, 2399296, 2399297, 2399298, 2399299, 2399300, 2399301, 2399302, 2399303, 2399304, 2399305, 2399306, 2399307, 2399308, 2399309, 2399312, 2399315, 2399316, 2399318, 2399319, 2399321, 2399324, 2399329, 2399330, 2399331, 2399332, 2399333, 2399337, 2399338, 2399339, 2399340, 2399350, 2399354, 2399355, 2399357, 2399358, 2399363, 2399366, 2399367, 2399368, 2399372, 2399374, 2399405, 2399416, 2399418, 2399446, 2399498, 2399502, 2399505, 2399508, 2399510, 2399514, 2399518, 2399521, 2399522, 2399523, 2399524, 2399525, 2399531, 2399533, 2399537, 2399543, 2399546, 2399549, 2399550, 2399551, 2399552, 2399554, 2399556, 2399558, 2399561, 2399562, 2399563, 2399565, 2399566, 2399569, 2399575, 2399577, 2399578, 2399579, 2399582, 2399589
|
|
|
| Bug Blocks: |
|
|
|
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.