kritik
CVE-2026-58459
gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Red Hat7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Oracle (yüksek), Rocky Linux (yüksek).
Açıklama
gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 10 | gpsd, gpsd-clients, python3-gpsd | 1:3.26.1-3.el10_2.1 |
| alma 9 | gpsd-minimal, gpsd-minimal-clients | 1:3.26.1-2.el9_8.1 |
| debian 11 | gpsd | düzeltme belirtilmemiş |
| debian 12 | gpsd | düzeltme belirtilmemiş |
| debian 13 | gpsd | 3.25-5+deb13u2 |
| debian 14 | gpsd | 3.27.5-1 |
| echo | gpsd | 3.25-5+deb13u2 |
| Oracle Linux 9 | gpsd-minimal, gpsd-minimal-clients | 1:3.26.1-2.0.1.el9_8.1 |
| rapidfort alma 10 | gpsd, gpsd-clients, python3-gpsd | 1:3.26.1-3.el10_2.1 |
| rapidfort alma 9 | gpsd-minimal, gpsd-minimal-clients | 1:3.26.1-2.el9_8.1 |
| rapidfort alpine 3.20 | gpsd | düzeltme belirtilmemiş |
| rapidfort alpine 3.21 | gpsd | düzeltme belirtilmemiş |
26 kaynaktaki 48 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 10 | gpsd | 1:3.26.1-3.el10_2.1 |
| alma 10 | gpsd-clients | 1:3.26.1-3.el10_2.1 |
| alma 10 | python3-gpsd | 1:3.26.1-3.el10_2.1 |
| alma 9 | gpsd-minimal | 1:3.26.1-2.el9_8.1 |
| alma 9 | gpsd-minimal-clients | 1:3.26.1-2.el9_8.1 |
| debian 11 | gpsd | düzeltme belirtilmemiş |
| debian 12 | gpsd | düzeltme belirtilmemiş |
| debian 13 | gpsd | 3.25-5+deb13u2 |
| debian 14 | gpsd | 3.27.5-1 |
| echo | gpsd | 3.25-5+deb13u2 |
| Oracle Linux 9 | gpsd-minimal | 1:3.26.1-2.0.1.el9_8.1 |
| Oracle Linux 9 | gpsd-minimal-clients | 1:3.26.1-2.0.1.el9_8.1 |
| rapidfort alma 10 | gpsd | 1:3.26.1-3.el10_2.1 |
| rapidfort alma 10 | gpsd-clients | 1:3.26.1-3.el10_2.1 |
| rapidfort alma 10 | python3-gpsd | 1:3.26.1-3.el10_2.1 |
| rapidfort alma 9 | gpsd-minimal | 1:3.26.1-2.el9_8.1 |
| rapidfort alma 9 | gpsd-minimal-clients | 1:3.26.1-2.el9_8.1 |
| rapidfort alpine 3.20 | gpsd | düzeltme belirtilmemiş |
| rapidfort alpine 3.21 | gpsd | düzeltme belirtilmemiş |
| rapidfort alpine 3.22 | gpsd | düzeltme belirtilmemiş |
| rapidfort alpine 3.23 | gpsd | düzeltme belirtilmemiş |
| rapidfort alpine 3.24 | gpsd | düzeltme belirtilmemiş |
| rapidfort debian 12 | gpsd | 0:3.25-5+deb13u2, 0:3.27.5-1 |
| rapidfort debian 13 | gpsd | 0:3.25-5+deb13u2, 0:3.27.5-1 |
| rapidfort fedora 43 | gpsd | 1:3.26.1-7.fc43 |
| rapidfort fedora 43 | gpsd-clients | 1:3.26.1-7.fc43 |
| rapidfort fedora 43 | gpsd-compat | 1:3.26.1-7.fc43 |
| rapidfort fedora 43 | gpsd-devel | 1:3.26.1-7.fc43 |
| rapidfort fedora 43 | gpsd-libs | 1:3.26.1-7.fc43 |
| rapidfort fedora 43 | gpsd-qt | 1:3.26.1-7.fc43 |
| rapidfort fedora 43 | gpsd-qt-devel | 1:3.26.1-7.fc43 |
| rapidfort fedora 43 | gpsd-xclients | 1:3.26.1-7.fc43 |
| rapidfort fedora 43 | python3-gpsd | 1:3.26.1-7.fc43 |
| rapidfort Oracle Linux 10 | gpsd | 1:3.26.1-3.0.1.el10_2.1 |
| rapidfort Oracle Linux 10 | gpsd-clients | 1:3.26.1-3.0.1.el10_2.1 |
| rapidfort Oracle Linux 10 | python3-gpsd | 1:3.26.1-3.0.1.el10_2.1 |
| rapidfort Oracle Linux 9 | gpsd-minimal | 1:3.26.1-2.0.1.el9_8.1 |
| rapidfort Oracle Linux 9 | gpsd-minimal-clients | 1:3.26.1-2.0.1.el9_8.1 |
| rapidfort rocky 9 | gpsd-minimal | 1:3.26.1-2.el9_8.1 |
| rapidfort rocky 9 | gpsd-minimal-clients | 1:3.26.1-2.el9_8.1 |
| rapidfort ubuntu 20.04 | gpsd | 0:3.27.5-1 |
| rapidfort ubuntu 22.04 | gpsd | 0:3.27.5-1 |
| rapidfort ubuntu 24.04 | gpsd | 0:3.27.5-1 |
| rocky 10 | gpsd | 1:3.26.1-3.el10_2.1 |
| rocky 10 | gpsd-clients | 1:3.26.1-3.el10_2.1 |
| rocky 10 | python3-gpsd | 1:3.26.1-3.el10_2.1 |
| rocky 9 | gpsd-minimal | 1:3.26.1-2.el9_8.1 |
| rocky 9 | gpsd-minimal-clients | 1:3.26.1-2.el9_8.1 |
Referanslar
- https://access.redhat.com/errata/RHSA-2026:51153
- https://access.redhat.com/security/cve/CVE-2026-58459
- https://bugzilla.redhat.com/2498575
- https://bugzilla.redhat.com/show_bug.cgi?id=2498575
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58459
- https://errata.almalinux.org/9/ALSA-2026-51153.html
- https://errata.rockylinux.org/RLSA-2026:51153
17 referansın hepsi
- https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf58aa940132e630870af061dc88537
- https://github.com/ntpsec/gpsd/commit/4c06658e988f4ced1a7a574ce082a22ef625df56
- https://github.com/ntpsec/gpsd/commit/5581ba196d826a984fbfaf792b7d58535f9911ce
- https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267
- https://linux.oracle.com/cve/CVE-2026-58459.html
- https://linux.oracle.com/errata/ELSA-2026-51153.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-58459
- https://www.cve.org/CVERecord?id=CVE-2026-58459
- https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-plot-title-subtype-field