From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Miroslav Lichvar To: git-commits@fedoraproject.org Subject: [rpms/gpsd] rawhide: fix command injection in gpsprof (CVE-2026-58459) Date: Mon, 13 Jul 2026 13:06:32 GMT Message-ID: <178394799299.1.10147782028893345104.rpms-gpsd-fbd0cb963510@fedoraproject.org> List-ID: X-Git-Repo: rpms/gpsd X-Git-Branch: rawhide X-Git-Rev: fbd0cb96351032beeb11d02b5482758874bce34a QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ3BzZApCcmFuY2gg OiByYXdoaWRlCkNvbW1pdCA6IGZiZDBjYjk2MzUxMDMyYmVlYjExZDAyYjU0ODI3NTg4NzRiY2Uz NGEKQXV0aG9yIDogTWlyb3NsYXYgTGljaHZhciA8bWxpY2h2YXJAcmVkaGF0LmNvbT4KRGF0ZSAg IDogMjAyNi0wNy0xM1QxNDo1MzozNiswMjowMApTdGF0cyAgOiArMTMyLy0wIGluIDIgZmlsZShz KQpVUkwgICAgOiBodHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2dwc2QvYy9mYmQw Y2I5NjM1MTAzMmJlZWIxMWQwMmI1NDgyNzU4ODc0YmNlMzRhP2JyYW5jaD1yYXdoaWRlCgpMb2c6 CmZpeCBjb21tYW5kIGluamVjdGlvbiBpbiBncHNwcm9mIChDVkUtMjAyNi01ODQ1OSkKCi0tLQpk aWZmIC0tZ2l0IGEvZ3BzZC1jdmUtMjAyNi01ODQ1OS5wYXRjaCBiL2dwc2QtY3ZlLTIwMjYtNTg0 NTkucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uOGUxMDcxMwotLS0g L2Rldi9udWxsCisrKyBiL2dwc2QtY3ZlLTIwMjYtNTg0NTkucGF0Y2gKQEAgLTAsMCArMSwxMzAg QEAKK2NvbW1pdCA1NTgxYmExOTZkODI2YTk4NGZiZmFmNzkyYjdkNTg1MzVmOTkxMWNlCitBdXRo b3I6IEdhcnkgRS4gTWlsbGVyIDxnZW1AcmVsbGltLmNvbT4KK0RhdGU6ICAgV2VkIEp1bCAxIDE3 OjU1OjU3IDIwMjYgLTA3MDAKKworICAgIGNsaWVudHMvZ3BzcHJvZi5weS5pbjogUXVvdGUgZG91 YmxlIHF1b3RlcyBpbiB0aXRsZS4KKyAgICAKKyAgICBTb21lb25lIGNvdWxkIHVzZSB0aGUgZG91 YmxlIHF1b3RlIHRvIGJyZWFrIG91dCBvZiB0aGUKKyAgICBzdHJpbmcgYW5kIGFkZCBnbnVwbG90 IGNvbW1uZHMuCisgICAgCisgICAgRm9yIGlzc3VlIDQwNC4KKyAgICBSZXBvcnRlZCBieTogQ3VC M3kwbmQsIGFuZCBXYWRlIFNwYXJrcyA8d3NwYXJrc0B2dWxuY2hlY2suY29tPgorCitkaWZmIC0t Z2l0IGEvY2xpZW50cy9ncHNwcm9mLnB5LmluIGIvY2xpZW50cy9ncHNwcm9mLnB5LmluCitpbmRl eCA1YzE4ZjUwZmYuLjI2MWU3MjY2NSAxMDA2NDQKKy0tLSBhL2NsaWVudHMvZ3BzcHJvZi5weS5p bgorKysrIGIvY2xpZW50cy9ncHNwcm9mLnB5LmluCitAQCAtMTk4LDYgKzE5OCwxMCBAQCBjbGFz cyBwbG90dGVyKG9iamVjdCk6CisgICAgICAgICBpZiAnc3VidHlwZScgaW4gc2VsZi5kZXZpY2U6 CisgICAgICAgICAgICAgZGVzYyArPSAiXFxuJXMiICUgc2VsZi5kZXZpY2VbJ3N1YnR5cGUnXQor IAorKyAgICAgICAgIyBlc2NhcGUgIiwgYW5kIFxuLCBmb3IgZ251cGxvdCwgdG8gbm90IGJyZWFr IHN0cmluZ3MKKysgICAgICAgIGRlc2MgPSBkZXNjLnJlcGxhY2UoJyInLCAnXFwwNDInKQorKyAg ICAgICAgZGVzYyA9IGRlc2MucmVwbGFjZSgnXG4nLCAnJykKKysKKyAgICAgICAgIHJldHVybiBk ZXNjCisgCisgICAgIGRlZiBjb2xsZWN0KHNlbGYsIHZlcmIsIGxvZ19mcD1Ob25lKToKK0BAIC0x MjYyLDEwICsxMjY2LDEwIEBAIGlmIF9fbmFtZV9fID09ICdfX21haW5fXyc6CisgICAgICAgICAj IFNoaXAgdGhlIHBsb3QgdG8gc3RhbmRhcmQgb3V0cHV0CisgICAgICAgICBpZiBub3Qgb3B0aW9u cy50aXRsZToKKyAgICAgICAgICAgICBvcHRpb25zLnRpdGxlID0gcGxvdC53aGF0YW1pKCkKKy0g ICAgICAgICAgICAjIGVzY2FwZSAiIGZvciBnbnVwbG90CistICAgICAgICAgICAgb3B0aW9ucy50 aXRsZSA9IG9wdGlvbnMudGl0bGUucmVwbGFjZSgnIicsICdcXCInKQorICAgICAgICAgaWYgb3B0 aW9ucy5zdWJ0aXRsZToKKyAgICAgICAgICAgICBvcHRpb25zLnRpdGxlICs9ICdcXG4nICsgb3B0 aW9ucy5zdWJ0aXRsZQorKyAgICAgICAgIyBlc2NhcGUgIiBmb3IgZ251cGxvdCwgdG8gbm90IGJy ZWFrIHN0cmluZ3MKKysgICAgICAgIG9wdGlvbnMudGl0bGUgPSBvcHRpb25zLnRpdGxlLnJlcGxh Y2UoJyInLCAnXFwwNDInKQorICAgICAgICAgdGVybV9vcHRzID0gIiIKKyAgICAgICAgIHRydWVj b2xvcl90ZXJtcyA9IFsncG5nJywgJ3NpeGVsZ2QnLCAnd3h0J10KKyAgICAgICAgIGlmIG9wdGlv bnMudGVybWluYWwgaW4gdHJ1ZWNvbG9yX3Rlcm1zOgorCitjb21taXQgMWE2YmI3YmNiZGY1OGFh OTQwMTMyZTYzMDg3MGFmMDYxZGM4ODUzNworQXV0aG9yOiBHYXJ5IEUuIE1pbGxlciA8Z2VtQHJl bGxpbS5jb20+CitEYXRlOiAgIFR1ZSBKdWwgNyAxMzo0MTo1NCAyMDI2IC0wNzAwCisKKyAgICBj bGllbnRzL2dwc3Byb2YucHkuaW46IFF1b3RlIGJhY2sgdGlja3MgaW4gdGl0bGUuCisgICAgCisg ICAgU29tZW9uZSBjb3VsZCB1c2UgdGhlIGJhY2sgdGljayB0byBicmVhayBvdXQgb2YgdGhlIHN0 cmluZyBhbmQgYWRkCisgICAgZ251cGxvdCBjb21tbmRzLgorICAgIAorICAgIEZvciBpc3N1ZSA0 MDQuCisgICAgUmVwb3J0ZWQgYnk6IEN1QjN5MG5kLCBhbmQgV2FkZSBTcGFya3MgPHdzcGFya3NA dnVsbmNoZWNrLmNvbT4KKworZGlmZiAtLWdpdCBhL2NsaWVudHMvZ3BzcHJvZi5weS5pbiBiL2Ns aWVudHMvZ3BzcHJvZi5weS5pbgoraW5kZXggMjYxZTcyNjY1Li4yMDIyMTQ3NjkgMTAwNjQ0Cist LS0gYS9jbGllbnRzL2dwc3Byb2YucHkuaW4KKysrKyBiL2NsaWVudHMvZ3BzcHJvZi5weS5pbgor QEAgLTE5OCw4ICsxOTgsOSBAQCBjbGFzcyBwbG90dGVyKG9iamVjdCk6CisgICAgICAgICBpZiAn c3VidHlwZScgaW4gc2VsZi5kZXZpY2U6CisgICAgICAgICAgICAgZGVzYyArPSAiXFxuJXMiICUg c2VsZi5kZXZpY2VbJ3N1YnR5cGUnXQorIAorLSAgICAgICAgIyBlc2NhcGUgIiwgYW5kIFxuLCBm b3IgZ251cGxvdCwgdG8gbm90IGJyZWFrIHN0cmluZ3MKKysgICAgICAgICMgZXNjYXBlICIsIGAs IGFuZCBcbiwgZm9yIGdudXBsb3QsIHRvIG5vdCBicmVhayBzdHJpbmdzCisgICAgICAgICBkZXNj ID0gZGVzYy5yZXBsYWNlKCciJywgJ1xcMDQyJykKKysgICAgICAgIGRlc2MgPSBkZXNjLnJlcGxh Y2UoJ2AnLCAnXFwxNDAnKQorICAgICAgICAgZGVzYyA9IGRlc2MucmVwbGFjZSgnXG4nLCAnJykK KyAKKyAgICAgICAgIHJldHVybiBkZXNjCitAQCAtMTI2OCw4ICsxMjY5LDkgQEAgaWYgX19uYW1l X18gPT0gJ19fbWFpbl9fJzoKKyAgICAgICAgICAgICBvcHRpb25zLnRpdGxlID0gcGxvdC53aGF0 YW1pKCkKKyAgICAgICAgIGlmIG9wdGlvbnMuc3VidGl0bGU6CisgICAgICAgICAgICAgb3B0aW9u cy50aXRsZSArPSAnXFxuJyArIG9wdGlvbnMuc3VidGl0bGUKKy0gICAgICAgICMgZXNjYXBlICIg Zm9yIGdudXBsb3QsIHRvIG5vdCBicmVhayBzdHJpbmdzCisrICAgICAgICAjIGVzY2FwZSAiLCAg YW5kYCwgZm9yIGdudXBsb3QsIHRvIG5vdCBicmVhayBzdHJpbmdzCisgICAgICAgICBvcHRpb25z LnRpdGxlID0gb3B0aW9ucy50aXRsZS5yZXBsYWNlKCciJywgJ1xcMDQyJykKKysgICAgICAgIG9w dGlvbnMudGl0bGUgPSBvcHRpb25zLnRpdGxlLnJlcGxhY2UoJyInLCAnXFwxNDAnKQorICAgICAg ICAgdGVybV9vcHRzID0gIiIKKyAgICAgICAgIHRydWVjb2xvcl90ZXJtcyA9IFsncG5nJywgJ3Np eGVsZ2QnLCAnd3h0J10KKyAgICAgICAgIGlmIG9wdGlvbnMudGVybWluYWwgaW4gdHJ1ZWNvbG9y X3Rlcm1zOgorCitjb21taXQgNGMwNjY1OGU5ODhmNGNlZDFhN2E1NzRjZTA4MmEyMmVmNjI1ZGY1 NgorQXV0aG9yOiBHYXJ5IEUuIE1pbGxlciA8Z2VtQHJlbGxpbS5jb20+CitEYXRlOiAgIFR1ZSBK dWwgNyAxNDoyMzo1NiAyMDI2IC0wNzAwCisKKyAgICBjbGllbnRzL2dwc3Byb2YucHkuaW46IFF1 b3RlIGJhY2sgdGlja3MgaW4gdGl0bGUuCisgICAgCisgICAgU2Vjb25kIHRyeS4gIEFsc28gcXVv dGUgInRlcm1pbmFsIi4KKyAgICAKKyAgICBTb21lb25lIGNvdWxkIHVzZSB0aGUgYmFjayB0aWNr IHRvIGJyZWFrIG91dCBvZiB0aGUgc3RyaW5nIGFuZCBhZGQKKyAgICBnbnVwbG90IGNvbW1uZHMu CisgICAgCisgICAgRm9yIGlzc3VlIDQwNC4KKyAgICBSZXBvcnRlZCBieTogQ3VCM3kwbmQsIGFu ZCBXYWRlIFNwYXJrcyA8d3NwYXJrc0B2dWxuY2hlY2suY29tPgorCitkaWZmIC0tZ2l0IGEvY2xp ZW50cy9ncHNwcm9mLnB5LmluIGIvY2xpZW50cy9ncHNwcm9mLnB5LmluCitpbmRleCAyMDIyMTQ3 NjkuLmU5MTM2N2VlMyAxMDA2NDQKKy0tLSBhL2NsaWVudHMvZ3BzcHJvZi5weS5pbgorKysrIGIv Y2xpZW50cy9ncHNwcm9mLnB5LmluCitAQCAtMjAwLDcgKzIwMCw3IEBAIGNsYXNzIHBsb3R0ZXIo b2JqZWN0KToKKyAKKyAgICAgICAgICMgZXNjYXBlICIsIGAsIGFuZCBcbiwgZm9yIGdudXBsb3Qs IHRvIG5vdCBicmVhayBzdHJpbmdzCisgICAgICAgICBkZXNjID0gZGVzYy5yZXBsYWNlKCciJywg J1xcMDQyJykKKy0gICAgICAgIGRlc2MgPSBkZXNjLnJlcGxhY2UoJ2AnLCAnXFwxNDAnKQorKyAg ICAgICAgZGVzYyA9IGRlc2MucmVwbGFjZSgiXHg2MCIsICdcXDE0MCcpCisgICAgICAgICBkZXNj ID0gZGVzYy5yZXBsYWNlKCdcbicsICcnKQorIAorICAgICAgICAgcmV0dXJuIGRlc2MKK0BAIC0x MjcxLDEzICsxMjcxLDE5IEBAIGlmIF9fbmFtZV9fID09ICdfX21haW5fXyc6CisgICAgICAgICAg ICAgb3B0aW9ucy50aXRsZSArPSAnXFxuJyArIG9wdGlvbnMuc3VidGl0bGUKKyAgICAgICAgICMg ZXNjYXBlICIsICBhbmRgLCBmb3IgZ251cGxvdCwgdG8gbm90IGJyZWFrIHN0cmluZ3MKKyAgICAg ICAgIG9wdGlvbnMudGl0bGUgPSBvcHRpb25zLnRpdGxlLnJlcGxhY2UoJyInLCAnXFwwNDInKQor LSAgICAgICAgb3B0aW9ucy50aXRsZSA9IG9wdGlvbnMudGl0bGUucmVwbGFjZSgnIicsICdcXDE0 MCcpCisrICAgICAgICBvcHRpb25zLnRpdGxlID0gb3B0aW9ucy50aXRsZS5yZXBsYWNlKCJceDYw IiwgJ1xcMTQwJykKKyAgICAgICAgIHRlcm1fb3B0cyA9ICIiCisgICAgICAgICB0cnVlY29sb3Jf dGVybXMgPSBbJ3BuZycsICdzaXhlbGdkJywgJ3d4dCddCisgICAgICAgICBpZiBvcHRpb25zLnRl cm1pbmFsIGluIHRydWVjb2xvcl90ZXJtczoKKyAgICAgICAgICAgICB0ZXJtX29wdHMgPSAndHJ1 ZWNvbG9yJworLSAgICAgICAgc3lzLnN0ZG91dC53cml0ZSgic2V0IHRlcm1pbmFsICVzIHNpemUg ODAwLDk1MCAlc1xuIgorLSAgICAgICAgICAgICAgICAgICAgICAgICAic2V0IHRlcm1vcHRpb24g ZW5oYW5jZWRcbiIKKysKKysgICAgICAgICMgZXNjYXBlICIsIGAsIGFuZCBcbiwgZm9yIGdudXBs b3QsIHRvIG5vdCBicmVhayBzdHJpbmdzCisrICAgICAgICBvcHRpb25zLnRlcm1pbmFsID0gb3B0 aW9ucy50ZXJtaW5hbC5yZXBsYWNlKCciJywgJ1xcMDQyJykKKysgICAgICAgIG9wdGlvbnMudGVy bWluYWwgPSBvcHRpb25zLnRlcm1pbmFsLnJlcGxhY2UoIlx4NjAiLCAnXFwxNDAnKQorKyAgICAg ICAgb3B0aW9ucy50ZXJtaW5hbCA9IG9wdGlvbnMudGVybWluYWwucmVwbGFjZSgnXG4nLCAnJykK KysKKysgICAgICAgIHN5cy5zdGRvdXQud3JpdGUoJ3NldCB0ZXJtaW5hbCAiJXMiIHNpemUgODAw LDk1MCAlc1xuJworKyAgICAgICAgICAgICAgICAgICAgICAgICAnc2V0IHRlcm1vcHRpb24gZW5o YW5jZWRcbicKKyAgICAgICAgICAgICAgICAgICAgICAgICAgJSAob3B0aW9ucy50ZXJtaW5hbCwg dGVybV9vcHRzKSkKKyAgICAgICAgICMgZG91YmxlIHF1b3RlcyBvbiB0aXRsZSBzbyBcbiBpcyBw YXJzZWQgYnkgZ251cGxvdAorICAgICAgICAgc3lzLnN0ZG91dC53cml0ZSgnc2V0IHRpdGxlIG5v ZW5oYW5jZWQgIiVzXFxuXFxuIlxuJyAlIG9wdGlvbnMudGl0bGUpCgpkaWZmIC0tZ2l0IGEvZ3Bz ZC5zcGVjIGIvZ3BzZC5zcGVjCmluZGV4IDNkYTljOGIuLmNhNmJiMGYgMTAwNjQ0Ci0tLSBhL2dw c2Quc3BlYworKysgYi9ncHNkLnNwZWMKQEAgLTM0LDYgKzM0LDggQEAgU291cmNlMTE6ICAgICAg IGdwc2Quc3lzY29uZmlnCiAKICMgQWRkIG9sZCBzdGF0dXMgbmFtZXMgdG8gZ3BzLmggZm9yIGNv bXBhdGliaWxpdHkKIFBhdGNoMTogICAgICAgICBncHNkLWFwaXN0YXR1cy5wYXRjaAorIyBGaXgg Y29tbWFuZCBpbmplY3Rpb24gaW4gZ3BzcHJvZgorUGF0Y2gyOiAgICAgICAgIGdwc2QtY3ZlLTIw MjYtNTg0NTkucGF0Y2gKIAogQnVpbGRSZXF1aXJlczogIGdjYwogQnVpbGRSZXF1aXJlczogIGRi dXMtZGV2ZWwK