Debian Patches
Status for modules/5.6.1-3
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| configure.patch | Add missing component support | Alastair McKinstry <mckinstry@debian.org> | no | |||
| fix-command-injection-in-bash-Tab-completion-comp-v5.6.x.patch | sh: fix command injection in bash Tab completion (compgen -W expansion) _module_comgen_words_and_files() fed untrusted text (module names read off disk, LOADEDMODULES, MODULEPATH) straight into `compgen -W`, which performs a full unquoted-word expansion on its wordlist -- including command substitution -- as a normal, documented part of its behavior. A module name, loaded-module entry, or MODULEPATH component containing e.g. `$(...)` therefore ran arbitrary shell code the moment a user pressed Tab. _module_comgen_words() splits the candidate list with `read -r -d ''` (pure IFS word-splitting, no expansion of any kind) and does the prefix match itself; _module_comgen_words_and_files() now layers the nospace-for-directory-entries behavior on top of it. Every call site that previously built a compgen -W wordlist from LOADEDMODULES, MODULEPATH, or a stash/save collection name now goes through one of these two functions instead. Cherry-picked and adapted from the fix already applied to the main branch, adjusted to this branch's completion script layout. Verified with a live bash session: an injected LOADEDMODULES entry is now listed as an inert candidate string, with no code execution. |
Xavier Delaruelle <xavier.delaruelle@cea.fr> | no | 2026-08-13 |