fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. This design flaw was introduced in very early versions of fish, predating the version control system, and is thought to be present in every version of fish released in the last 15 years or more, although with different characters. Code execution does not appear to be possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) is potentially possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish     shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will     incorrectly allow these markers to be read on command substitution output, rather than transforming them     into a safe internal representation. While this may cause unexpected behavior with direct input (for     example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if     the output is being fed from an external program into a command substitution where this output may not be     expected. This design flaw was introduced in very early versions of fish, predating the version control     system, and is thought to be present in every version of fish released in the last 15 years or more,     although with different characters. Code execution does not appear to be possible, but denial of service     (through large brace expansion) or information disclosure (such as variable expansion) is potentially     possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are     advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-49284)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0404-1 advisory.

  - fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish     shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will     incorrectly allow these markers to be read on command substitution output, rather than transforming them     into a safe internal representation. While this may cause unexpected behavior with direct input (for     example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if     the output is being fed from an external program into a command substitution where this output may not be     expected. This design flaw was introduced in very early versions of fish, predating the version control     system, and is thought to be present in every version of fish released in the last 15 years or more,     although with different characters. Code execution does not appear to be possible, but denial of service     (through large brace expansion) or information disclosure (such as variable expansion) is potentially     possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are     advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-49284)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0405-1 advisory.

  - fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish     shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will     incorrectly allow these markers to be read on command substitution output, rather than transforming them     into a safe internal representation. While this may cause unexpected behavior with direct input (for     example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if     the output is being fed from an external program into a command substitution where this output may not be     expected. This design flaw was introduced in very early versions of fish, predating the version control     system, and is thought to be present in every version of fish released in the last 15 years or more,     although with different characters. Code execution does not appear to be possible, but denial of service     (through large brace expansion) or information disclosure (such as variable expansion) is potentially     possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are     advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-49284)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
227196	Linux Distros Unpatched Vulnerability : CVE-2023-49284	Nessus	Misc.	Local	medium
187043	openSUSE 15 Security Update : fish (openSUSE-SU-2023:0404-1)	Nessus	SuSE Local Security Checks	Local	medium
187042	openSUSE 15 Security Update : fish (openSUSE-SU-2023:0405-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2023-49284

medium

Tenable Plugins

medium

medium

medium