Code Execution Vulnerability in GNU Global Package - CVE-2024-38448
Summary
DEBIAN-CVE-2024-38448: htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used. Affects global versions < 6.6.13-1. Fixed in 6.6.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Global is a source code tagging system that provides a set of tools for source code navigation. It is widely used by developers to facilitate code searching and browsing. The package allows users to manage and navigate large codebases efficiently. However, it has been found to be vulnerable to a code execution flaw when the database path (dbpath) is untrusted, particularly in versions prior to 6.6.13.
Vulnerability Detail
The vulnerability identified as CVE-2024-38448 exists in GNU Global versions up to 6.6.12. It allows for code execution due to improper handling of shell metacharacters in the dbpath parameter. If an attacker can control the dbpath input, they can execute arbitrary commands on the system, leading to potential system compromise. This vulnerability arises from the lack of proper input validation and sanitization, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
6.6.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade globalTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using untrusted paths for the dbpath parameter. Ensure that the input to dbpath is sanitized and validated to prevent the execution of shell metacharacters.
Conclusion
The CVE-2024-38448 vulnerability in GNU Global poses a significant risk due to its potential for code execution through untrusted database paths. Users are strongly encouraged to update to the latest version to mitigate this risk. Additionally, employing input validation and sanitization can help prevent exploitation until the update is applied.
See every vulnerability recorded for global →
FAQ
CVE-2024-38448 is a vulnerability in the GNU Global package that allows for code execution through untrusted database paths.
Versions of GNU Global prior to 6.6.13 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, ensure that you do not use untrusted paths for the dbpath parameter and validate all inputs.
More information about GNU Global can be found on its official website and documentation, which provides insights into its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for global.
