CVE-2014-3219 — Link Following in Fish

CWE-59 — Link FollowingCWE-79 — Cross-site Scripting7 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 89.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Fishshell FishOpenstack HorizonDebian Fish+1 more
Timeline
PublishedFeb 9
Latest updateMay 17

Description

fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/fish< fish 2.1.1-1 (bookworm)
▶NVDfishshell/fish< 2.1.1
▶Debianfishshell/fish< 2.1.1-1+3
▶PyPIopenstack/horizon< 8.0.0a0

Also affects: Fedora 19

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability↗2022-05-17
▶
GHSA
GHSA-x4v8-3282-qp44: fish before 2↗2022-05-13
▶
OSV
CVE-2014-3219: fish before 2↗2018-02-09
▶

📋Vendor Advisories

2
Red Hat
python-django-horizon: XSS in Heat stack creation↗2015-06-09
▶
Debian
CVE-2014-3219: fish - fish before 2.1.1 allows local users to write to arbitrary files via a symlink a...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-2905 CVE-2014-2906 CVE-2014-2914 CVE-2014-3219 fish: multiple flaws fixed in upstream 2.1.1↗2014-04-28
▶
CVE-2014-3219 — Link Following in Fishshell Fish | cvebase