CVE-2022-24953 (published 2022-02-17T05:15Z)

The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-88
cwe_name: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
extended_description: 
            When creating commands using interpolation into a string, developers may assume that only the arguments/options that they specify will be processed.  This assumption may be even stronger when the programmer has encoded the command in a way that prevents separate commands from being provided maliciously, e.g. in the case of shell metacharacters.  When constructing the command, the developer may use whitespace or other delimiters that are required to separate arguments when the command. However, if an attacker can provide an untrusted input that contains argument-separating delimiters, then the resulting command will have more arguments than intended by the developer.  The attacker may then be able to change the behavior of the command.  Depending on the functionality supported by the extraneous arguments, this may have security-relevant consequences.
         
         

Fix information:
repo_url: https://github.com/pear/Crypt_GPG
commit_details: repo_url: https://github.com/pear/Crypt_GPG
author: Aleksander Machniak
author_date: 2022-02-16 18:39:00+01:00
msg: Prepare 1.6.7 release
repository: repo_url: https://github.com/pear/Crypt_GPG
repo_name: pear/Crypt_GPG
description: Encrypt/decrypt PGP messages with PHP
repo_language: PHP
owner: pear
file_changes: filename: package.php
change_type: ModificationType.MODIFY
diff: @@ -33,14 +33,13 @@
 require_once 'PEAR/PackageFileManager2.php';
 PEAR::setErrorHandling(PEAR_ERROR_DIE);
 
-$apiVersion     = '1.6.6';
+$apiVersion     = '1.6.7';
 $apiState       = 'stable';
 
-$releaseVersion = '1.6.6';
+$releaseVersion = '1.6.7';
 $releaseState   = 'stable';
-$releaseNotes   = "Fix possible infinite loop.\n"
-    . "Use configured debug handler also in CLI.\n"
-    . "Support generating keys without a user name.";
+$releaseNotes   = "[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].\n"
+    . "Ignore tests/debug.log and .gitattributes itself.";
 
 $description =
     "This package provides an object oriented interface to GNU Privacy " .

programming_language: PHP
filename: package.xml
change_type: ModificationType.MODIFY
diff: @@ -29,11 +29,11 @@ This package requires PHP version 5.4.8 or greater.</description>
   <email>alec@alec.pl</email>
   <active>yes</active>
  </lead>
- <date>2021-09-05</date>
- <time>10:27:54</time>
+ <date>2022-02-16</date>
+ <time>18:38:44</time>
  <version>
-  <release>1.6.6</release>
-  <api>1.6.6</api>
+  <release>1.6.7</release>
+  <api>1.6.7</api>
  </version>
  <stability>
   <release>stable</release>
@@ -41,9 +41,8 @@ This package requires PHP version 5.4.8 or greater.</description>
  </stability>
  <license uri="http://www.gnu.org/copyleft/lesser.html">LGPL</license>
  <notes>
-Fix possible infinite loop.
-Use configured debug handler also in CLI.
-Support generating keys without a user name.
+[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].
+Ignore tests/debug.log and .gitattributes itself.
  </notes>
  <contents>
   <dir baseinstalldir="/" name="/">
@@ -167,19 +166,18 @@ Support generating keys without a user name.
  <changelog>
   <release>
    <version>
-    <release>1.6.6</release>
-    <api>1.6.6</api>
+    <release>1.6.7</release>
+    <api>1.6.7</api>
    </version>
    <stability>
     <release>stable</release>
     <api>stable</api>
    </stability>
-   <date>2021-09-05</date>
+   <date>2022-02-16</date>
    <license uri="http://www.gnu.org/copyleft/lesser.html">LGPL</license>
    <notes>
-Fix possible infinite loop.
-Use configured debug handler also in CLI.
-Support generating keys without a user name.
+[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].
+Ignore tests/debug.log and .gitattributes itself.
    </notes>
   </release>
  </changelog>

programming_language: PHP
repo_url: https://github.com/pear/Crypt_GPG
commit_details: repo_url: https://github.com/pear/Crypt_GPG
author: Thomas Chauchefoin
author_date: 2022-02-10 08:50:44+01:00
msg: Insert the end-of-options marker before operation arguments.

This marker stops the parsing of additional options during external
calls to GPG. This behavior is unintended but its security impact is
dependent on the environment and the GPG version in use.
repository: repo_url: https://github.com/pear/Crypt_GPG
repo_name: pear/Crypt_GPG
description: Encrypt/decrypt PGP messages with PHP
repo_language: PHP
owner: pear
file_changes: filename: GPG.php
change_type: ModificationType.MODIFY
diff: @@ -427,7 +427,7 @@ class Crypt_GPG extends Crypt_GPGAbstract
             );
         }
 
-        $operation = '--delete-key ' . escapeshellarg($fingerprint);
+        $operation = '--delete-key -- ' . escapeshellarg($fingerprint);
         $arguments = array(
             '--batch',
             '--yes'
@@ -474,7 +474,7 @@ class Crypt_GPG extends Crypt_GPGAbstract
             );
         }
 
-        $operation = '--delete-secret-key ' . escapeshellarg($fingerprint);
+        $operation = '--delete-secret-key -- ' . escapeshellarg($fingerprint);
         $arguments = array(
             '--batch',
             '--yes'
@@ -546,7 +546,7 @@ class Crypt_GPG extends Crypt_GPGAbstract
     public function getFingerprint($keyId, $format = self::FORMAT_NONE)
     {
         $output    = '';
-        $operation = '--list-keys ' . escapeshellarg($keyId);
+        $operation = '--list-keys -- ' . escapeshellarg($keyId);
         $arguments = array(
             '--with-colons',
             '--with-fingerprint'
@@ -1464,7 +1464,7 @@ class Crypt_GPG extends Crypt_GPGAbstract
 
         $keyData   = '';
         $operation = $private ? '--export-secret-keys' : '--export';
-        $operation .= ' ' . escapeshellarg($fingerprint);
+        $operation .= ' -- ' . escapeshellarg($fingerprint);
         $arguments = $armor ? array('--armor') : array();
 
         $this->engine->reset();

programming_language: PHP
filename: GPGAbstract.php
change_type: ModificationType.MODIFY
diff: @@ -334,7 +334,7 @@ abstract class Crypt_GPGAbstract
         if ($keyId == '') {
             $operation = '--list-secret-keys';
         } else {
-            $operation = '--utf8-strings --list-secret-keys ' . escapeshellarg($keyId);
+            $operation = '--utf8-strings --list-secret-keys -- ' . escapeshellarg($keyId);
         }
 
         // According to The file 'doc/DETAILS' in the GnuPG distribution, using
@@ -366,7 +366,7 @@ abstract class Crypt_GPGAbstract
         if ($keyId == '') {
             $operation = '--list-public-keys';
         } else {
-            $operation = '--utf8-strings --list-public-keys ' . escapeshellarg($keyId);
+            $operation = '--utf8-strings --list-public-keys -- ' . escapeshellarg($keyId);
         }
 
         $output = '';

programming_language: PHP