CVE-2022-23935

NameCVE-2022-23935
Descriptionlib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libimage-exiftool-perl (PTS)bullseye12.16+dfsg-2vulnerable
bookworm12.57+dfsg-1fixed
sid, trixie12.76+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libimage-exiftool-perlsource(unstable)12.38+dfsg-1

Notes

[bullseye] - libimage-exiftool-perl <no-dsa> (Minor issue)
[buster] - libimage-exiftool-perl <no-dsa> (Minor issue)
[stretch] - libimage-exiftool-perl <no-dsa> (Minor issue)
https://github.com/exiftool/exiftool/commit/74dbab1d2766d6422bb05b033ac6634bf8d1f582 (12.38)

Search for package or bug name: Reporting problems