PT-2023-1670 · Debian+2 · Debian-Goodies+3

Jakub Wilk · Published 2023-03-05 · Updated 2026-03-18 · CVE-2023-27635

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions debian-goodies version 0.88.1

Description The issue is related to the debmany function in the debian-goodies package, which allows attackers to execute arbitrary shell commands due to an eval call. This can be achieved via a crafted .deb file. The path is shown to the user before execution. The vulnerability is caused by the lack of measures to neutralize special elements used in the operating system command when processing .deb files, which can allow an attacker to execute arbitrary commands.

Recommendations For version 0.88.1, consider disabling the eval call in the debmany function as a temporary workaround until a patch is available. Restrict access to the debmany function to minimize the risk of exploitation. Avoid using crafted .deb files until the issue is resolved.

Fix

OS Command Injection

Special Elements Injection

Weakness Enumeration

CWE-78

CWE-74

Related Identifiers

BDU:2023-01240

CVE-2023-27635

USN-6714-1

USN-8109-1

Affected Products

Debian

Linuxmint

Ubuntu

Debian-Goodies

References · 16

• https://bugs.debian.org/1031267 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6714-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-27635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27635 · Security Note
• https://osv.dev/vulnerability/USN-8109-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27635 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-27635 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6714-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01240 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-27635 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-27635 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-27635 · Security Note
• https://ubuntu.com/security/notices/USN-8109-1 · Vendor Advisory
• https://salsa.debian.org/debian/debian-goodies/-/commit/495eaafa94d2b4cbee4eed01cd78238e311d096b · Note
• https://vuldb.com/?id.222339 · Note