CVE-2022-20001
published 2022-03-14CVE-2022-20001: fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository…
PriorityP342high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.42%
70.1th percentile
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs `git` commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the `fish_git_prompt` function from the prompt.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | fish | < fish 3.4.0+ds-1 (bookworm) | fish 3.4.0+ds-1 (bookworm) |
| debian | powerline-gitstatus | < powerline-gitstatus 1.3.2-1 (bookworm) | powerline-gitstatus 1.3.2-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fishshell | fish | >= 0 < 3.1.2-3+deb11u1 | 3.1.2-3+deb11u1 |
| fishshell | fish | >= 0 < 3.4.0+ds-1 | 3.4.0+ds-1 |
| fishshell | fish | >= 0 < 3.4.0+ds-1 | 3.4.0+ds-1 |
| fishshell | fish | >= 0 < 3.4.0+ds-1 | 3.4.0+ds-1 |
| fishshell | fish | 3.1.0 – 3.3.1 | — |
| msrc | cbl2_fish_on_cbl_mariner_2.0 | — | — |
| powerline_gitstatus_project | powerline_gitstatus | < 1.3.2 | 1.3.2 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
ghsa7.8HIGH
osv7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
fish vulnerability
vendor_ubuntu·2022-08-10
CVE-2022-20001 fish vulnerability
Title: fish vulnerability
Summary: fish could be made to run programs if it read data from a specially
crafted file.
Justin Steven discovered that fish was not properly filtering local
git configuration directives when running background git commands.
A remote unauthenticated attacker could possibly use this issue to
execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Injection in fish
vendor_msrc·2022-03-08·CVSS 7.8
CVE-2022-20001 [HIGH] CWE-74 Injection in fish
Injection in fish
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure
Debian
CVE-2022-20001: fish - fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulner...
vendor_debian·2022·CVSS 7.8
CVE-2022-20001 [HIGH] CVE-2022-20001: fish - fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulner...
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs `git` commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger
Debian
CVE-2022-42906: powerline-gitstatus - powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code...
vendor_debian·2022·CVSS 7.8
CVE-2022-42906 [HIGH] CVE-2022-42906: powerline-gitstatus - powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code...
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
Scope: local
bookworm: resolved (fixed in 1.3.2-1)
bullseye: resolved (fixed in 1.3.2-0+deb11u1)
forky: resolved (fixed in 1.3.2-1)
sid: r
OSV
apache2 vulnerabilities
osv·2023-02-01·CVSS 7.5
CVE-2006-20001 apache2 vulnerabilities
apache2 vulnerabilities
It was discovered that the Apache HTTP Server mod_dav module incorrectly
handled certain If: request headers. A remote attacker could possibly use
this issue to cause the server to crash, resulting in a denial of service.
(CVE-2006-20001)
ZeddYu_Lu discovered that the Apache HTTP Server mod_proxy_ajp module
incorrectly interpreted certain HTTP Requests. A remote attacker could
possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-36760)
Dimas Fariski Setyawan Putra discovered that the Apache HTTP Server
mod_proxy module incorrectly truncated certain response headers. This may
result in later headers not being interpreted by the client.
(CVE-2022-37436)
OSV
apache2 vulnerabilities
osv·2023-01-31·CVSS 7.5
CVE-2006-20001 apache2 vulnerabilities
apache2 vulnerabilities
It was discovered that the Apache HTTP Server mod_dav module did not
properly handle specially crafted request headers. A remote attacker
could possibly use this issue to cause the process to crash, leading
to a denial of service. (CVE-2006-20001)
It was discovered that the Apache HTTP Server mod_proxy_ajp module did not
properly handle certain invalid Transfer-Encoding headers. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-36760)
GHSA
Powerline Gitstatus vulnerable to arbitrary code execution
ghsa·2022-10-13·CVSS 7.8
CVE-2022-42906 [HIGH] CWE-77 Powerline Gitstatus vulnerable to arbitrary code execution
Powerline Gitstatus vulnerable to arbitrary code execution
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
OSV
CVE-2022-42906: powerline-gitstatus (aka Powerline Gitstatus) before 1
osv·2022-10-13·CVSS 7.8
CVE-2022-42906 [HIGH] CVE-2022-42906: powerline-gitstatus (aka Powerline Gitstatus) before 1
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
OSV
Powerline Gitstatus vulnerable to arbitrary code execution
osv·2022-10-13·CVSS 7.8
CVE-2022-42906 [HIGH] Powerline Gitstatus vulnerable to arbitrary code execution
Powerline Gitstatus vulnerable to arbitrary code execution
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
OSV
CVE-2022-20001: fish is a command line shell
osv·2022-03-14·CVSS 7.8
CVE-2022-20001 [HIGH] CVE-2022-20001: fish is a command line shell
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs `git` commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/fish-shell/fish-shell/pull/8589https://github.com/fish-shell/fish-shell/releases/tag/3.4.0https://github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mqhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPZ7JV22DSZB5LNUCUEJ2HO3PKM2TVVK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRNMYS2LKB6TKOOBQQRSRQICDMWLZ4QL/https://security.gentoo.org/glsa/202309-10https://www.debian.org/security/2022/dsa-5234https://github.com/fish-shell/fish-shell/pull/8589https://github.com/fish-shell/fish-shell/releases/tag/3.4.0https://github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mqhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPZ7JV22DSZB5LNUCUEJ2HO3PKM2TVVK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRNMYS2LKB6TKOOBQQRSRQICDMWLZ4QL/https://security.gentoo.org/glsa/202309-10https://www.debian.org/security/2022/dsa-5234
2022-03-14
Published