CVE-2023-27635

Name of the Vulnerable Software and Affected Versions debian-goodies version 0.88.1

Description The issue is related to the debmany function in the debian-goodies package, which allows attackers to execute arbitrary shell commands due to an eval call. This can be achieved via a crafted .deb file. The path is shown to the user before execution. The vulnerability is caused by the lack of measures to neutralize special elements used in the operating system command when processing .deb files, which can allow an attacker to execute arbitrary commands.

Recommendations For version 0.88.1, consider disabling the eval call in the debmany function as a temporary workaround until a patch is available. Restrict access to the debmany function to minimize the risk of exploitation. Avoid using crafted .deb files until the issue is resolved.