Bugzilla – Bug 869906
VUL-0: CVE-2013-7345: file: extensive backtracking in awk rule regular expression
Last modified: 2019-05-01 17:18:18 UTC
via rh#1079846 bugzilla A flaw was reported in the rules file uses to detect AWK scripts. A malicious input file could cause the file utility to use 100% CPU. Upstream bug: http://bugs.gw.com/view.php?id=164 Upstream fix: https://github.com/file/file/commit/ef2329cf71acb59204dd981e2c6cce6c81fe467c Relevant regular expression check for AWK file type via the following commit: https://github.com/file/file/commit/e6b4015#diff-632ed2944e6b92e4b16ae8447f4f6e66 It first appear in version 5.05. References: https://bugzilla.redhat.com/show_bug.cgi?id=1079846
if it appears it only in 5.05, only openSUSE and SLE12 need it.
file-5.17/magic/Magdir/commands !:mime text/x-awk 0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text ... SLES12 is on secure side
The same for openSUSE Factory
openSUSE:13.1 is safe update/openSUSE_13.1> grep -B1 BEGIN file-5.15/magic/Magdir/commands !:mime text/x-awk 0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
openSUSE:12.3 SR#227307
This is an autogenerated message for OBS integration: This bug (869906) was mentioned in https://build.opensuse.org/request/show/227307 12.3 / file
bugbot adjusting priority
This is an autogenerated message for OBS integration: This bug (869906) was mentioned in https://build.opensuse.org/request/show/227736 12.3 / file
openSUSE-SU-2014:0481-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 869906 CVE References: CVE-2013-7345 Sources used: openSUSE 12.3 (src): file-5.11-12.23.1, python-magic-5.11-12.23.1
all packages fixed