CVE-2022-42906

NameCVE-2022-42906
Descriptionpowerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
powerline-gitstatus (PTS)buster1.3.1-1vulnerable
bullseye1.3.1-2vulnerable
bookworm, sid1.3.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
powerline-gitstatussource(unstable)1.3.2-1

Notes

[bullseye] - powerline-gitstatus <no-dsa> (Minor issue)
[buster] - powerline-gitstatus <ignored> (Minor issue and solution require the user to reconfigure)
https://github.com/jaspernbrouwer/powerline-gitstatus/issues/45
https://github.com/jaspernbrouwer/powerline-gitstatus/pull/46

Search for package or bug name: Reporting problems