diff options
| author | Adam Weinberger <adamw@FreeBSD.org> | 2026-03-19 21:21:51 +0000 |
|---|---|---|
| committer | Adam Weinberger <adamw@FreeBSD.org> | 2026-03-19 21:26:36 +0000 |
| commit | a215214dc5d94d8906ebddd92640062e91b0fd7b (patch) | |
| tree | c5b3ea3676fc172c7cedf14ece644a85765e3280 /databases/py-xapian | |
| parent | 56d776168ea6ffe1321f2db6901eef9a963a5c3b (diff) | |
In particular, this addresses the following:
Problem: The glob() function on Unix-like systems does not escape
newline characters when expanding wildcards. A maliciously
crafted string containing '\n' can be used as a command
separator to execute arbitrary shell commands via
mch_expand_wildcards(). This depends on the user's 'shell'
setting.
Solution: Add the newline character ('\n') to the SHELL_SPECIAL
definition to ensure it is properly escaped before being
passed to the shell (pyllyukko).
Security: GHSA-w5jw-f54h-x46c
Diffstat (limited to 'databases/py-xapian')
0 files changed, 0 insertions, 0 deletions
