CVE-2022-24953: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 5.3
Published: 2022-02-17T05:15Z
Repository: https://github.com/pear/Crypt_GPG
Language: PHP
Files changed: package.php, package.xml
Commit date: 2022-02-16 18:39:00 +0100
Commit message: Prepare 1.6.7 release

Diff: diff --git a/package.php b/package.php
index 51cac13..393072d 100644
--- a/package.php
+++ b/package.php
@@ -31,18 +31,17 @@
  */
 
 require_once 'PEAR/PackageFileManager2.php';
 PEAR::setErrorHandling(PEAR_ERROR_DIE);
 
-$apiVersion     = '1.6.6';
+$apiVersion     = '1.6.7';
 $apiState       = 'stable';
 
-$releaseVersion = '1.6.6';
+$releaseVersion = '1.6.7';
 $releaseState   = 'stable';
-$releaseNotes   = "Fix possible infinite loop.\n"
-    . "Use configured debug handler also in CLI.\n"
-    . "Support generating keys without a user name.";
+$releaseNotes   = "[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].\n"
+    . "Ignore tests/debug.log and .gitattributes itself.";
 
 $description =
     "This package provides an object oriented interface to GNU Privacy " .
     "Guard (GnuPG). It requires the GnuPG executable to be on the system.\n\n" .
     "Though GnuPG can support symmetric-key cryptography, this package is " .
diff --git a/package.xml b/package.xml
index cf5a72b..d883453 100644
--- a/package.xml
+++ b/package.xml
@@ -27,25 +27,24 @@ This package requires PHP version 5.4.8 or greater.</description>
   <name>Aleksander Machniak</name>
   <user>alec</user>
   <email>alec@alec.pl</email>
   <active>yes</active>
  </lead>
- <date>2021-09-05</date>
- <time>10:27:54</time>
+ <date>2022-02-16</date>
+ <time>18:38:44</time>
  <version>
-  <release>1.6.6</release>
-  <api>1.6.6</api>
+  <release>1.6.7</release>
+  <api>1.6.7</api>
  </version>
  <stability>
   <release>stable</release>
   <api>stable</api>
  </stability>
  <license uri="http://www.gnu.org/copyleft/lesser.html">LGPL</license>
  <notes>
-Fix possible infinite loop.
-Use configured debug handler also in CLI.
-Support generating keys without a user name.
+[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].
+Ignore tests/debug.log and .gitattributes itself.
  </notes>
  <contents>
   <dir baseinstalldir="/" name="/">
    <dir name="Crypt">
     <dir name="GPG">
@@ -165,22 +164,21 @@ Support generating keys without a user name.
   </filelist>
  </phprelease>
  <changelog>
   <release>
    <version>
-    <release>1.6.6</release>
-    <api>1.6.6</api>
+    <release>1.6.7</release>
+    <api>1.6.7</api>
    </version>
    <stability>
     <release>stable</release>
     <api>stable</api>
    </stability>
-   <date>2021-09-05</date>
+   <date>2022-02-16</date>
    <license uri="http://www.gnu.org/copyleft/lesser.html">LGPL</license>
    <notes>
-Fix possible infinite loop.
-Use configured debug handler also in CLI.
-Support generating keys without a user name.
+[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].
+Ignore tests/debug.log and .gitattributes itself.
    </notes>
   </release>
  </changelog>
 </package>

Vulnerable code: $apiVersion     = '1.6.6';
$releaseVersion = '1.6.6';
$releaseNotes   = "Fix possible infinite loop.\n"
    . "Use configured debug handler also in CLI.\n"
    . "Support generating keys without a user name.";
 <date>2021-09-05</date>
 <time>10:27:54</time>
  <release>1.6.6</release>
  <api>1.6.6</api>
Fix possible infinite loop.
Use configured debug handler also in CLI.
Support generating keys without a user name.
    <release>1.6.6</release>
    <api>1.6.6</api>
   <date>2021-09-05</date>
Fix possible infinite loop.
Use configured debug handler also in CLI.
Support generating keys without a user name.
Fixed code: $apiVersion     = '1.6.7';
$releaseVersion = '1.6.7';
$releaseNotes   = "[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].\n"
    . "Ignore tests/debug.log and .gitattributes itself.";
 <date>2022-02-16</date>
 <time>18:38:44</time>
  <release>1.6.7</release>
  <api>1.6.7</api>
[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].
Ignore tests/debug.log and .gitattributes itself.
    <release>1.6.7</release>
    <api>1.6.7</api>
   <date>2022-02-16</date>
[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].
Ignore tests/debug.log and .gitattributes itself.