PT-2021-21337 · Sharkdp+1 · Sharkdp Bat+1

Ryotak · Published 2021-07-15 · Updated 2021-09-21 · CVE-2021-36753

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sharkdp BAT versions prior to 0.18.2

Description The issue arises when sharkdp BAT executes less.exe from the current working directory, potentially leading to unintended code execution.

Recommendations For versions prior to 0.18.2, update to version 0.18.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the less.exe program in the current working directory to minimize the risk of exploitation.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

ALT-PU-2021-2506

ALT-PU-2021-2850

CVE-2021-36753

GHSA-P24J-H477-76Q3

RUSTSEC-2021-0106

Affected Products

Alt Linux

Sharkdp Bat

References · 14

• https://github.com/sharkdp/bat/commit/bf2b2df9c9e218e35e5a38ce3d03cffb7c363956 · Patch
• https://github.com/sharkdp/bat/pull/1724 · Patch
• https://osv.dev/vulnerability/GHSA-p24j-h477-76q3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36753 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0106 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36753 · Vendor Advisory
• https://github.com/sharkdp/bat/releases/tag/v0.18.2 · Note
• https://github.com/sharkdp/bat · Note
• https://t.me/cvenotify/18190 · Telegram Post
• https://crates.io/crates/bat · Note
• https://t.me/cibsecurity/26203 · Telegram Post
• https://vuln.ryotak.me/advisories/53 · Note
• https://t.me/cvenotify/17705 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2021-0106.html · Note