Ubuntu alert USN-7130-1 (gh)
| From: | Julia Sarris <julia.sarris@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-7130-1] GitHub CLI vulnerability | |
| Date: | Tue, 26 Nov 2024 15:55:19 -0500 | |
| Message-ID: | <2ce33571-ea2c-40de-b0f1-5b8169363fd3@canonical.com> |
========================================================================== Ubuntu Security Notice USN-7130-1 November 26, 2024 gh vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.10 - Ubuntu 24.04 LTS Summary: GitHub CLI could be made to run programs as your login if it connected to a malicious server. Software Description: - gh: GitHub CLI, GitHub’s official command line tool Details: It was discovered that GitHub CLI incorrectly handled username validation. An attacker could possibly use this issue to perform remote code execution if the user connected to a malicious server. (CVE-2024-52308) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.10 gh 2.46.0-1ubuntu0.2 Ubuntu 24.04 LTS gh 2.45.0-1ubuntu0.2+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7130-1 <https://ubuntu.com/security/notices/USN-7130-1> CVE-2024-52308 Package Information: https://launchpad.net/ubuntu/+source/gh/2.46.0-1ubuntu0.2 <https://launchpad.net/ubuntu/+source/gh/2.46.0-1ubuntu0.2>
Attachment: None (type=text/html)
(HTML attachment elided)
Attachment: OpenPGP_0x401EFCBCDA0FF1BD.asc (type=application/pgp-keys)
-----BEGIN PGP PUBLIC KEY BLOCK----- xsBNBGao8McBCAD/mTHpWpp0rMyhX+xQYmuj1DoCiadFZysyAyKIFXODXRSOAQ58 YTf6BEuhPtEamZq+aJEGOTBJmUZxvGMv0Fo5yBN+OGoMA2CJQwxWQCZCptfivOCI D5p2eANebDVXpZHHgpNwCyFVZR/UfSLMqX/y2wEi1AC4CKc3ihFBWdMJVdDk6zz0 4g/x4w76CZczUpe17QWD1XuAWUxmaVGM/TiKjktq3Lp6yZrb0QSYjCovXAGwfBmz beludDi+EMDmh76PeKWfqQ38QSPEvN+Lv6OTjPWDfilfuOPpDZA2gsjNj3TaBllL k9YW98OrqsbegQ0BhPgoPYQ3S15ikv53M8o/ABEBAAHNKUp1bGlhIFNhcnJpcyA8 anVsaWEuc2FycmlzQGNhbm9uaWNhbC5jb20+wsCRBBMBCgA7FiEEOMd9M4Vpc6WH Yvv+QB78vNoP8b0FAmao8McCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AA CgkQQB78vNoP8b3fXQf6Awx8Nd5FkMMGdrWqBjIPZv1Ogkka2+PiIqwqcIeQGvam V/bpIKOCb4QOS4kgQ+hNS1mmK+T/aWXRCYhiBIPAOIbo7jcMGxNz7V3+43RxlNVl zt3feYM/QAJmgK8bjdCzI5ZQHiyX8pgOieCylRrcjroQHa9CxHej4aJGCaPGLFGo 81lYWJm21NP4LJTLk03ncJT8Ss64R28cOWUHujysxftAPHVYpPLdlwuJ3lgC8M5n eq0qwsv22j62ldd/J7u2psRSczaU1ve/TfX71ZCyZZiw2Tm5HvaskD+CilXOaL2H +KediuEtkQk5KKQikg2XtjbqCYyIxQT50v1TIu86ss7ATQRmqPDHAQgA5zGDufJq 9MhhDPJqM3Qz4kQXLKDXz2l5EovU5olrYerGmskpUBUSwfgAeBu9gMP5Y24spir3 eMm6O7m8EJsihMPCw4Iblzi9YZZX1TY3wegRXFIiaqW5kELnjhVnRpS9WQi9FDd9 gGPp7X3iQ8/B6+nyHitqhcj2A+Vpk5HaguY8zl3yEOwFnud5TEbSb/xYz7DhX5uv B/FZ9rgn+j2N0hC/RVN1MpSRHZEbOCfpaYr/teiQexOWBlVVnZgCkHb9F0NiNImv dXVZ18jY5wfgxemfgm8l4nDUlSMUIMiwGYekPMEuYvoDNPwfzzlYHKrVoqp54KMd JALMUar1bVZtxQARAQABwsB2BBgBCgAgFiEEOMd9M4Vpc6WHYvv+QB78vNoP8b0F Amao8McCGwwACgkQQB78vNoP8b10+ggA8nW+R2g9BDvkpurM0lwpaCtgKbaENIGg lpxNXEEUEW7AaR4Mme+4PA/SdpWrFzVa0OGhqtZxkovUZXpgiLlx5/eR1Bl+TUuO rjZkjGBy3r2Ce1JLwKilSZk7Bk45L7QDxA+NOLSFS7ADqzv37J2jhpfczqrYdpSj kHgUvkapbuB0ONpQ/mhH9UDquY3eMGv3GSrvggVS0mKjR6bMl1plBWcfJ+Y//xQc 6S1bBdjbmwKMZjYbvhTpPbVeUOUdOg/0mYC/3rjSO+2OEn1Q+YIdfGqbLpDAbruG m7XHtUOXesWorhDMzQGRpj7R+ed/9uJs0Nvg5FqAKTrzh+90ngEGuA== =Qkbp -----END PGP PUBLIC KEY BLOCK-----
Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- wsB5BAABCAAjFiEEOMd9M4Vpc6WHYvv+QB78vNoP8b0FAmdGNbgFAwAAAAAACgkQQB78vNoP8b2K Ywf+IrOBQuyKPbI6FlZzAM8lxDXxa5dm3W6qjbAGlYM09VQTkTAso3CfYAGatX6bupc3zTTSJZMu Hv+FEReO9xfL+KuTnnFElKacqz+JEyXiPZsjlso2XkBmjqsPHU6AQsOoI5cHRJg6xnLmD505emZv ONRj7lz4RJv5zUbSs6iWX6EIvnI06XuiCsBBZKkeVreIEtq7Q0o8VM4Mz/sXFCVjrfvGxVWEEVm0 SBm8647iGJ8157HxgNvrRzcvuh1TvhO7NT+l2NBtSiIIMD44zI64fDHnKbRvNz3wV1XhIk/l6zLA cgnzldVWKYQXSAGQETeVcgWmloYqAbvc1a08uYo/Xw== =X/U/ -----END PGP SIGNATURE-----
Attachment: None (type=text/plain)