PT-2021-23126 · Unknown+1 · Qutebrowser+1

Ping Fan (Zetta) Ke · Published 2020-10-29 · Updated 2022-10-24 · CVE-2021-41146

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions qutebrowser versions 1.7.0 through 2.3.x

Description The issue allows arbitrary code execution via commands such as :spawn or :debug-pyeval when a specially crafted qutebrowserurl: URL is opened with certain applications. Only Windows installs where qutebrowser is registered as a URL handler are affected. The fix also adds additional hardening for potential similar issues on Linux.

Recommendations For qutebrowser versions 1.7.x, apply the backported patch d1ceaab. For qutebrowser versions 1.8.x, apply the backported patch ca7155d. For qutebrowser versions 1.9.x, apply the backported patch 157d871. For qutebrowser versions 1.10.x, apply the backported patch 94a6125. For qutebrowser versions 1.11.x, apply the backported patch 10acfbb. For qutebrowser versions 1.12.x, apply the backported patch 363a18f. For qutebrowser versions 1.13.x, apply the backported patch 410f262. For qutebrowser versions 1.14.x, apply the backported patch e4f4d93. For qutebrowser versions 2.0.x, apply the backported patch 15a1654. For qutebrowser versions 2.1.x, apply the backported patch 509ddf2. For qutebrowser versions 2.2.x, apply the backported patch 03dcba5. For qutebrowser versions 2.3.x, apply the backported patch 00a694c. For all affected versions, remove qutebrowser from the default browser settings entirely to prevent it from handling any kind of URLs.

Fix

Command Injection

Argument Injection

Weakness Enumeration

CWE-77

CWE-641

CWE-88

Related Identifiers

ALT-PU-2020-3156

ALT-PU-2021-3096

ALT-PU-2022-1436

CVE-2021-41146

GHSA-VW27-FWJF-5QXM

PYSEC-2021-382

Affected Products

Alt Linux

Qutebrowser

References · 10

• https://github.com/qutebrowser/qutebrowser/commit/8f46ba3f6dc7b18375f7aa63c48a1fe461190430 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41146 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-382 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vw27-fwjf-5qxm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41146 · Vendor Advisory
• https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-vw27-fwjf-5qxm · Note
• https://github.com/qutebrowser/qutebrowser · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/qutebrowser/PYSEC-2021-382.yaml · Note
• https://t.me/cibsecurity/30972 · Telegram Post
• https://t.me/cvenotify/22535 · Telegram Post