5.5 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): HIGH
- Availability impact (A): NONE
Activity log
- Created suggestion
uutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsing
A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options. This vulnerability can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes rather than the intended literal characters.
References
-
-
https://github.com/uutils/coreutils/releases/tag/0.8.0 vendor-advisory
Affected products
- <0.8.0
Matching in nixpkgs
pkgs.coreutils
GNU Core Utilities
pkgs.coreutils-full
GNU Core Utilities
pkgs.policycoreutils
SELinux policy core utilities
pkgs.uutils-coreutils
Cross-platform Rust rewrite of the GNU coreutils
pkgs.coreutils-prefixed
GNU Core Utilities
pkgs.uutils-coreutils-noprefix
Cross-platform Rust rewrite of the GNU coreutils
pkgs.minimal-bootstrap.coreutils
The GNU Core Utilities
pkgs.selinuxPackages.policycoreutils
SELinux policy core utilities
pkgs.minimal-bootstrap.coreutils-musl
The GNU Core Utilities
pkgs.minimal-bootstrap.coreutils-static
The GNU Core Utilities
Package maintainers
-
@dasJ Janne Heß <janne@hess.ooo>
-
@mdaniels5757 Michael Daniels <nix@mdaniels.me>
-
@infinisil Silvan Mosberger <contact@infinisil.com>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@balsoft Alexander Bantyev <balsoft75@gmail.com>
-
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>
-
@Gskartwii Aleksi Hannula <ahannula4@gmail.com>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>
-
@emilytrau Emily Trau <emily+nix@downunderctf.com>
-
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
-
@Artturin Artturi N <artturin@artturin.com>
-
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
-
@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>
-
@numinit Morgan Jones <me+nixpkgs@numin.it>
-
@matthiasbeyer Matthias Beyer <mail@beyermatthias.de>
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>