Re: Fixing src:ucf environmnent variable insecurity in [old]stable

Hi Mark, and thanks for the heads-up, CC'ing the LTS mailing list for visibility. BCC'ing debian-devel. El 19/12/24 a las 17:50, Mark Hindley escribió: > Hello, > > I recently completed salvaging of src:ucf[1]. > > As part of code cleanup I discovered a variable inherited from the environment >

Fixing src:ucf environmnent variable insecurity in [old]stable

Hello, I recently completed salvaging of src:ucf[1]. As part of code cleanup I discovered a variable inherited from the environment which is then passed to eval[2]. Unintended code execution is trivial to demonstrate. To my mind, this is a coding oversight. As the patch in #1089015 shows, the fi