Logo
componentzsh
Name
zsh
Version
5.8
Type
library
Description
UNIX Shell similar to the Korn shell
Licenses
zsh
PURL
-
CPE
cpe:2.3:*:zsh:zsh:5.8:*:*:*:*:*:*:*

Other Versions#


Project
Branch
Version
master
5.9.1
scarthgap
5.8

Patches#


#
Title
Author
Resolve
1
security/41: Don't perform PROMPT_SUBST evaluation on
Oliver Kiddle <opk@zsh.org>
CVE-2021-45444
2
security/89: Add patch which can optionally be used to
Marc Cornellà <hello@mcornella.com>
CVE-2021-45444
3
CVE-2021-45444: Update NEWS/README
dana <dana@dana.is>
CVE-2021-45444

Vulnerabilities#


Name
Analysis
Description
Patched
In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.