PT-2021-21596 · Ohmyzsh · Ohmyzsh

Published 2021-11-30 · Updated 2021-12-01 · CVE-2021-3727

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ohmyzsh versions prior to the version that includes commit 72928432

Description The issue concerns command injection through quotes fetched from external APIs by the rand-quote and hitokoto plugins. These plugins process quotes from quotationspage.com and hitokoto.cn, respectively, and then print them using print -P. If the quotes contain specific symbols, they could trigger command injection. Since the quotes come from external APIs, it's not possible to guarantee their safety. The quote function in the rand-quote plugin and the hitokoto function in the hitokoto plugin are impacted.

Recommendations As a temporary workaround, consider disabling the quote function in the rand-quote plugin and the hitokoto function in the hitokoto plugin until a patch is available. Update to a version that includes commit 72928432 to resolve the issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-3727

Affected Products

Ohmyzsh

References · 5

• https://github.com/ohmyzsh/ohmyzsh/commit/72928432 · Patch
• https://osv.dev/vulnerability/CVE-2021-3727 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3727 · Security Note
• https://t.me/cvenotify/24032 · Telegram Post
• https://t.me/cibsecurity/33076 · Telegram Post