From 10fa105f05e432bb09ca9750246e1c3a975160f2 Mon Sep 17 00:00:00 2001 From: Jon Moroney Date: Thu, 9 Sep 2021 15:40:15 -0700 Subject: [PATCH] Add rustsec advisory for GHSA-p24j-h477-76q3 (#1017) * Add rustsec advisory for GHSA-p24j-h477-76q3 * Update crates/bat/RUSTSEC-0000-0000.md Co-authored-by: Alex Gaynor * Update RUSTSEC-0000-0000.md Capitalize `windows` to conform with https://docs.rs/platforms/1.1.0/platforms/target/enum.OS.html * Update RUSTSEC-0000-0000.md Add [affected] section Co-authored-by: Alex Gaynor --- crates/bat/RUSTSEC-0000-0000.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 crates/bat/RUSTSEC-0000-0000.md diff --git a/crates/bat/RUSTSEC-0000-0000.md b/crates/bat/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..3bf0f79 --- /dev/null +++ b/crates/bat/RUSTSEC-0000-0000.md @@ -0,0 +1,18 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "bat" +date = "2021-07-15" +url = "https://nvd.nist.gov/vuln/detail/CVE-2021-36753" +categories = ["code-execution"] +cvss = "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" +aliases = ["CVE-2021-36753"] +[affected] +os = ["windows"] +[versions] +patched = [">= 0.18.2"] +``` + +# Uncontrolled Search Path Element in sharkdp/bat + +bat on windows before 0.18.2 executes programs named less.exe from the current working directory. This can lead to unintended code execution.