From 02e0f94fff27cad2ba4e65bdc4b21146b3bd9a97 Mon Sep 17 00:00:00 2001

From: Oliver Kiddle <opk@zsh.org>

Date: Wed, 15 Dec 2021 01:56:40 +0100

Subject: [PATCH 1/2] security/41: Don't perform PROMPT_SUBST evaluation on

 %F/%K arguments

Mitigates CVE-2021-45444

Upstream-commit: c187154f47697cdbf822c2f9d714d570ed4a0fd1

Signed-off-by: Kamil Dudka <kdudka@redhat.com>

---

 Src/prompt.c | 10 ++++++++++

 1 file changed, 10 insertions(+)

diff --git a/Src/prompt.c b/Src/prompt.c

index b65bfb8..91e21c8 100644

--- a/Src/prompt.c

+++ b/Src/prompt.c

@@ -244,6 +244,12 @@ parsecolorchar(zattr arg, int is_fg)

 	bv->fm += 2; /* skip over F{ */

 	if ((ep = strchr(bv->fm, '}'))) {

 	    char oc = *ep, *col, *coll;

+	    int ops = opts[PROMPTSUBST], opb = opts[PROMPTBANG];

+	    int opp = opts[PROMPTPERCENT];

+

+	    opts[PROMPTPERCENT] = 1;

+	    opts[PROMPTSUBST] = opts[PROMPTBANG] = 0;

+

 	    *ep = '\0';

 	    /* expand the contents of the argument so you can use

 	     * %v for example */

@@ -252,6 +258,10 @@ parsecolorchar(zattr arg, int is_fg)

 	    arg = match_colour((const char **)&coll, is_fg, 0);

 	    free(col);

 	    bv->fm = ep;

+

+	    opts[PROMPTSUBST] = ops;

+	    opts[PROMPTBANG] = opb;

+	    opts[PROMPTPERCENT] = opp;

 	} else {

 	    arg = match_colour((const char **)&bv->fm, is_fg, 0);

 	    if (*bv->fm != '}')

-- 

2.34.1

From 6102afb5dfd7c704f9cf99bedb9c3ec3c7dbe8e3 Mon Sep 17 00:00:00 2001

From: dana <dana@dana.is>

Date: Tue, 21 Dec 2021 13:13:33 -0600

Subject: [PATCH 2/2] CVE-2021-45444: Update NEWS/README

Upstream-commit: bdc4d70a7e033b754e68a8659a037ea0fc5f38de

Signed-off-by: Kamil Dudka <kdudka@redhat.com>

---

 NEWS   | 20 ++++++++++++++++++++

 README |  6 ++++++

 2 files changed, 26 insertions(+)

diff --git a/NEWS b/NEWS

index 964e163..327b449 100644

--- a/NEWS

+++ b/NEWS

@@ -4,6 +4,26 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH

 Note also the list of incompatibilities in the README file.

+Changes since 5.8

+-----------------

+

+CVE-2021-45444: Some prompt expansion sequences, such as %F, support

+'arguments' which are themselves expanded in case they contain colour

+values, etc. This additional expansion would trigger PROMPT_SUBST

+evaluation, if enabled. This could be abused to execute code the user

+didn't expect. e.g., given a certain prompt configuration, an attacker

+could trick a user into executing arbitrary code by having them check

+out a Git branch with a specially crafted name.

+

+This is fixed in the shell itself by no longer performing PROMPT_SUBST

+evaluation on these prompt-expansion arguments.

+

+Users who are concerned about an exploit but unable to update their

+binaries may apply the partial work-around described in the file

+Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell

+source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to

+Marc Cornellà <hello@mcornella.com>. ]

+

 Changes since 5.7.1-test-3

 --------------------------

diff --git a/README b/README

index 7f1dd5f..c9e994a 100644

--- a/README

+++ b/README

@@ -31,6 +31,12 @@ Zsh is a shell with lots of features.  For a list of some of these, see the

 file FEATURES, and for the latest changes see NEWS.  For more

 details, see the documentation.

+Incompatibilities since 5.8

+---------------------------

+

+PROMPT_SUBST expansion is no longer performed on arguments to prompt-

+expansion sequences such as %F.

+

 Incompatibilities since 5.7.1

 -----------------------------

-- 

2.34.1