PT-2020-9942 · Pacman · Pacman

Published 2020-02-24 · Updated 2022-01-01 · CVE-2019-18183

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pacman versions prior to 5.2

Description The issue allows for arbitrary command injection in the apply deltas() function, located in lib/libalpm/sync.c. This can be exploited when unsigned databases are used, and the user has enabled the non-default delta feature. The exploitation requires the user to retrieve an attacker-controlled crafted database and delta file.

Recommendations For versions prior to 5.2, update to version 5.2 or later to resolve the issue. As a temporary workaround, consider disabling the delta feature until a patch is available. Avoid using unsigned databases to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-18183

Affected Products

Pacman

References · 9

• 🔥 https://git.archlinux.org/pacman.git/tree/lib/libalpm/sync.c?h=v5.1.3#n767 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18183 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K53C45EDWBU3UCN3IRIGR5EZUNWXS7BW · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2TTUXXUW5OCOASIRMJK4RHEPLEA33Y6C · Vendor Advisory
• https://git.archlinux.org/pacman.git/commit/?id=c0e9be7973be6c81b22fde91516fb8991e7bb07b · Patch
• https://osv.dev/vulnerability/CVE-2019-18183 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KIDJ4XKBZRRVRFFGKUA3ZU6NFIP5JUG3 · Vendor Advisory
• https://github.com/alpinelinux/alpine-secdb/blob/master/v3.11/community.yaml · Note
• https://t.me/cvenotify/1168 · Telegram Post