The --rpm-requires argument is documented to imply -n (i.e. don't execute any commands), but that does not hold true; commands in scripts are actually executed, making this a potentially dangerous problem. Tested on F-12, appears to affect Rawhide as well, FWIW CentOS 5.4's bash-3.2-24.el5 is not affected, don't know about other versions. $ rpm -q bash bash-4.0.35-2.fc12.x86_64 $ echo 'echo "hello from script" ; ls /root' > t.sh $ bash --rpm-requires t.sh executable(ls) hello from script ls: cannot open directory /root: Permission denied
Thanks for the report. I have done a mistake when reformatting patch. Affected bashes are all since F-11. I will do all necessary updates.
bash-4.0-10.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/bash-4.0-10.fc11
bash-4.0.35-3.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/bash-4.0.35-3.fc12
bash-4.1.2-4.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/bash-4.1.2-4.fc13
bash-4.0.35-3.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update bash'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/bash-4.0.35-3.fc12
bash-4.0.35-3.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
bash-4.1.2-4.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.