Files
third_party_rust_rust/tests
erjuan 3faac03fd7 [Backport]Fix windows bat file vulnerability
Offering: Open Source Management Center
CVE: CVE-2024-43402

Reference: https://github.com/rust-lang/rust/pull/129960/commits/b666f820546ad2fd15b591acc8dfd7e7f461147e
On April 9th, 2024, the Rust Security Response WG disclosed CVE-2024-24576,
where std::process::Command incorrectly escaped arguments when invoking batch files on Windows.
We were notified that our fix for the vulnerability was incomplete,
and it was possible to bypass the fix when the batch file name had trailing whitespace or periods
(which are ignored and stripped by Windows).

Signed-off-by: fengting <fengting11@huawei.com>
2024-11-12 20:15:47 +08:00
..
2023-05-13 10:32:32 +00:00