4.4 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): NONE
Activity log
- Created suggestion
uutils coreutils printenv Security Inspection Bypass via UTF-8 Enforcement
The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.
References
-
-
https://github.com/uutils/coreutils/releases/tag/0.6.0 vendor-advisory
Affected products
- <0.6.0
Matching in nixpkgs
pkgs.coreutils
GNU Core Utilities
pkgs.coreutils-full
GNU Core Utilities
pkgs.policycoreutils
SELinux policy core utilities
pkgs.uutils-coreutils
Cross-platform Rust rewrite of the GNU coreutils
pkgs.coreutils-prefixed
GNU Core Utilities
pkgs.uutils-coreutils-noprefix
Cross-platform Rust rewrite of the GNU coreutils
pkgs.minimal-bootstrap.coreutils
The GNU Core Utilities
pkgs.selinuxPackages.policycoreutils
SELinux policy core utilities
pkgs.minimal-bootstrap.coreutils-musl
The GNU Core Utilities
pkgs.minimal-bootstrap.coreutils-static
The GNU Core Utilities
Package maintainers
-
@dasJ Janne Heß <janne@hess.ooo>
-
@mdaniels5757 Michael Daniels <nix@mdaniels.me>
-
@infinisil Silvan Mosberger <contact@infinisil.com>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@balsoft Alexander Bantyev <balsoft75@gmail.com>
-
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>
-
@Gskartwii Aleksi Hannula <ahannula4@gmail.com>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>
-
@emilytrau Emily Trau <emily+nix@downunderctf.com>
-
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
-
@Artturin Artturi N <artturin@artturin.com>
-
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
-
@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>
-
@numinit Morgan Jones <me+nixpkgs@numin.it>
-
@matthiasbeyer Matthias Beyer <mail@beyermatthias.de>
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>