CVE-2021-23556: Command injection in guake
Summary
CVE-2021-23556: Command injection in guake. Affects guake versions < 3.8.5. Fixed in 3.8.5. How to fix ↓
Also tracked for
- guake · Debian:11
The same CVE-2021-23556 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Guake is a drop-down terminal for GNOME. It provides a convenient way for users to access a terminal window without the need to open a separate application. Guake version 3.8.5 and below are vulnerable to a command injection vulnerability. This vulnerability arises due to the exposure of the execute_command and execute_command_by_uuid methods via the d-bus interface. An attacker with malicious intent can exploit this vulnerability by sending dbus signals or running terminal commands, potentially leading to arbitrary command execution. It is important to note that exploitation of this vulnerability requires the user to have installed another malicious program capable of sending dbus signals or running terminal commands.
Vulnerability Detail
The vulnerability in Guake allows for command injection, which can be exploited by a malicious user to run arbitrary commands via the d-bus method. This can lead to unauthorized access, data leakage, or even complete compromise of the system. The vulnerability has a CVSS score of 6.4, indicating a moderate severity level. It is crucial for users to update to Guake version 3.8.5 or above to mitigate this vulnerability.
How To Fix
Minimum fixed version
3.8.5
This is the first release that contains the fix.
pip install --upgrade "guake==3.8.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to update Guake to the latest version.
Conclusion
In conclusion, Guake versions prior to 3.8.5 are vulnerable to a command injection vulnerability. Users should update to the latest version to mitigate this vulnerability. Regularly checking for updates and promptly applying them is essential for maintaining the security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for guake →
FAQ
Guake is a drop-down terminal for GNOME, providing quick access to a terminal window.
This vulnerability allows for command injection, potentially leading to unauthorized access, data leakage, or system compromise.
To fix this vulnerability, update Guake to version 3.8.5 or later.
No specific workaround is mentioned. Updating to the latest version is the recommended action.
The vulnerability has a CVSS score of 6.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for guake.
