4.4 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
uutils coreutils printenv Security Inspection Bypass via UTF-8 Enforcement
The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.
References
-
-
https://github.com/uutils/coreutils/releases/tag/0.6.0 vendor-advisory
Affected products
- <0.6.0
Matching in nixpkgs
pkgs.coreutils
GNU Core Utilities
pkgs.coreutils-full
GNU Core Utilities
pkgs.policycoreutils
SELinux policy core utilities
pkgs.uutils-coreutils
Cross-platform Rust rewrite of the GNU coreutils
pkgs.coreutils-prefixed
GNU Core Utilities
pkgs.uutils-coreutils-noprefix
Cross-platform Rust rewrite of the GNU coreutils
pkgs.minimal-bootstrap.coreutils
The GNU Core Utilities
pkgs.selinuxPackages.policycoreutils
SELinux policy core utilities
pkgs.minimal-bootstrap.coreutils-musl
The GNU Core Utilities
pkgs.minimal-bootstrap.coreutils-static
The GNU Core Utilities
Package maintainers
-
@dasJ Janne Heß <janne@hess.ooo>
-
@balsoft Alexander Bantyev <balsoft75@gmail.com>
-
@infinisil Silvan Mosberger <contact@infinisil.com>
-
@mdaniels5757 Michael Daniels <nix@mdaniels.me>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>
-
@Gskartwii Aleksi Hannula <ahannula4@gmail.com>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>
-
@emilytrau Emily Trau <emily+nix@downunderctf.com>
-
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
-
@Artturin Artturi N <artturin@artturin.com>
-
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
-
@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>
-
@numinit Morgan Jones <me+nixpkgs@numin.it>
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>
-
@matthiasbeyer Matthias Beyer <mail@beyermatthias.de>