CVE-2017-8799

Name of the Vulnerable Software and Affected Versions iRODS versions prior to 4.1.11 iRODS versions prior to 4.2.1

Description The issue allows execution of untrusted input via igetwild in iRODS, enabling other users, potentially anonymous, to execute remote shell commands through iRODS virtual pathnames. This can be exploited by retrieving a virtual iRODS pathname containing a semicolon via igetwild, which, being a Bash script, executes the part of the pathname following the semicolon in the user's shell.

Recommendations For versions prior to 4.1.11, update to version 4.1.11 or later. For versions prior to 4.2.1, update to version 4.2.1 or later.