Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME

[John Haxby <john.haxby () oracle com>]

> On 19 Sep 2016, at 19:32, Seth Arnold <seth.arnold () canonical com> wrote:
>
> On Sun, Sep 18, 2016 at 08:06:57PM +0100, John Haxby wrote:
> > > > > A little while ago, one of our users discovered that by setting the
> > > > > hostname to $(something unpleasant), bash would run "something
> > > > > unpleasant" when it expanded \h in the prompt string.
> > >
> > > This issue has been public since October, 2015 in Ubuntu's bug tracking
> > > system.
> >
> > Yes, the message was more to let people know that CVE-2016-0634  had
> > been assigned for this issue.   Do you have a link to the Ubuntu issue
> > and a different CVE number?
>
> Hello John; we did not assign a CVE number for this issue.
>
> Bernd Dietzel reported it at:
> https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1507025

Thanks.   CVE-2016-0634 can stand then.

[The internal process we follow for acquiring CVEs is heavily oriented towards closed source so my apologies for not 
bringing this forward sooner.]

jch

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail