Fedora has issued an advisory on April 19: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2DZYNRKKZWBH3JDTQAGHHR5FXA5MIEI/ Version 0.29 fixes 'clipbrowse command execution with multi-line clipboard text including "| sh"'
Source RPM: (none) => perl-Clipboard-0.280.0-1.mga9.src.rpmStatus comment: (none) => Fixed upstream in 0.29 (0.290.0)
Suggested advisory: ======================== The updated package fixes 'clipbrowse command execution with multi-line clipboard text including "| sh"'. References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2DZYNRKKZWBH3JDTQAGHHR5FXA5MIEI/ ======================== Updated package in core/updates_testing: ======================== perl-Clipboard-0.290.0-1.mga9 from SRPM: perl-Clipboard-0.290.0-1.mga9.src.rpm
Status comment: Fixed upstream in 0.29 (0.290.0) => (none)Status: NEW => ASSIGNEDAssignee: bugsquad => qa-bugs
RH mageia 9 x86_64 Searching about the issue I find a example https://github.com/shlomif/Clipboard/issues/11 To make it works, first you must copy the 2 lines and in console run clipbrowse This open https://www.example.com/ in browser and print p0wned in terminal LC_ALL=C urpmi --auto --auto-update medium "QA Testing (32-bit)" is up-to-date medium "QA Testing (64-bit)" is up-to-date medium "Core Release (distrib1)" is up-to-date medium "Core Updates (distrib3)" is up-to-date medium "Nonfree Release (distrib11)" is up-to-date medium "Nonfree Updates (distrib13)" is up-to-date medium "Tainted Release (distrib21)" is up-to-date medium "Tainted Updates (distrib23)" is up-to-date medium "Core 32bit Release (distrib31)" is up-to-date medium "Core 32bit Updates (distrib32)" is up-to-date medium "Nonfree 32bit Release (distrib36)" is up-to-date medium "Tainted 32bit Release (distrib41)" is up-to-date medium "Tainted 32bit Updates (distrib42)" is up-to-date installing perl-Clipboard-0.290.0-1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64 Preparing... ################################################################################################## 1/1: perl-Clipboard ################################################################################################## 1/1: removing perl-Clipboard-0.280.0-1.mga9.noarch ################################################################################################## After the update, the same example produces an empty browser window and any output in console, so I guess is OK
Whiteboard: (none) => MGA9-64-OKCC: (none) => andrewsfarm
Keywords: (none) => advisory
Validating.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0143.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED