FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2025-04-14 08:12:50 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
a3b10c9b-99d9-11ed-aa55-d05099fed512	shells/fish -- arbitrary code execution via git Peter Ammon reports: fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt. Discovery 2021-12-26 Entry 2023-01-21 fish >= 3.1.0 lt 3.4.0 CVE-2022-20001 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20001

VuXML ID

Description

a3b10c9b-99d9-11ed-aa55-d05099fed512

shells/fish -- arbitrary code execution via git

Peter Ammon reports:

fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.

Discovery 2021-12-26
Entry 2023-01-21
fish

>= 3.1.0 lt 3.4.0

CVE-2022-20001
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20001