An issue was found in dash. Dash executes code even if "-n" / noexec is specified.
External References: https://www.openwall.com/lists/oss-security/2020/11/11/3
Created dash tracking bugs for this issue: Affects: epel-all [bug 1903621] Affects: fedora-all [bug 1903620]
A fix is committed upstream here: https://git.kernel.org/pub/scm/utils/dash/dash.git/commit/?id=29d6f2148f10213de4e904d515e792d2cf8c968e Consensus seems to be that while this is security relevant information, it's not worthy of a CVE. The attack scenario would require that an attacker can provide arbitrary arguments to dash, but `-n` is always given and presumed to provide some security. It's hard to imagine that this would be useful (since no script or tty command source can be used `-n`), or even presumed safe given all the other, interacting arguments dash can interpret. If an attacker can perform command injection to `dash -n -c '<some-attacker-controlled-string>'`, that is a different vulnerability unrelated to `-n`.