Issued:
2020-02-20
Updated:
2020-02-20

RHSA-2020:0559 - Security Advisory

Synopsis

Important: ksh security update

Type/Severity

Security Advisory: Important

Topic

An update for ksh is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

KornShell (ksh) is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell (sh) and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard (IEEE Std 1003.2-1992).

Security Fix(es):

  • ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection (CVE-2019-14868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
  • Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
  • Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64

Fixes

  • BZ - 1757324 - CVE-2019-14868 ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
x86_64
ksh-20120801-253.el8_1.x86_64.rpm SHA-256: 1b57fc471f16cff00b8acc6a9efc0af0bcc70fa5ce3f6f6bcd65c66583015e31
ksh-debuginfo-20120801-253.el8_1.x86_64.rpm SHA-256: 99d6a334c323ea26cdc7bea00b712da5425db47fe5d89272b7c65e2e03a3dd59
ksh-debugsource-20120801-253.el8_1.x86_64.rpm SHA-256: 705ca071e841f068ef1a75a765fa5e57016bdaa22a360719d219e8c9ea9c76d4

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
x86_64
ksh-20120801-253.el8_1.x86_64.rpm SHA-256: 1b57fc471f16cff00b8acc6a9efc0af0bcc70fa5ce3f6f6bcd65c66583015e31
ksh-debuginfo-20120801-253.el8_1.x86_64.rpm SHA-256: 99d6a334c323ea26cdc7bea00b712da5425db47fe5d89272b7c65e2e03a3dd59
ksh-debugsource-20120801-253.el8_1.x86_64.rpm SHA-256: 705ca071e841f068ef1a75a765fa5e57016bdaa22a360719d219e8c9ea9c76d4

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
s390x
ksh-20120801-253.el8_1.s390x.rpm SHA-256: f37d2564100a1a2f54b5ecdd84f87fa4b3b55bf11fe9a66fd25c79a2f13b3e0b
ksh-debuginfo-20120801-253.el8_1.s390x.rpm SHA-256: b369ef7a103029ccd216557f1c6ab5cfc3b93535774ae02cf40c303b751df66a
ksh-debugsource-20120801-253.el8_1.s390x.rpm SHA-256: 16c874198f7f91234c296fdcaafa3ca09fc676033bcc3b9be2318a2a7b841a04

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
s390x
ksh-20120801-253.el8_1.s390x.rpm SHA-256: f37d2564100a1a2f54b5ecdd84f87fa4b3b55bf11fe9a66fd25c79a2f13b3e0b
ksh-debuginfo-20120801-253.el8_1.s390x.rpm SHA-256: b369ef7a103029ccd216557f1c6ab5cfc3b93535774ae02cf40c303b751df66a
ksh-debugsource-20120801-253.el8_1.s390x.rpm SHA-256: 16c874198f7f91234c296fdcaafa3ca09fc676033bcc3b9be2318a2a7b841a04

Red Hat Enterprise Linux for Power, little endian 8

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
ppc64le
ksh-20120801-253.el8_1.ppc64le.rpm SHA-256: 220328e3848dab762c31322385e519b1beb3871a111a22e583339fe3a940962d
ksh-debuginfo-20120801-253.el8_1.ppc64le.rpm SHA-256: b63fe052609770976a4595ab59ddd07f43355e2e8c01b856c738bf7bfd586cbc
ksh-debugsource-20120801-253.el8_1.ppc64le.rpm SHA-256: 9e2aa1f1b33ffe3c7f2dcc927b3eff5096d97f9ff5124ce1487832b51d052d87

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
ppc64le
ksh-20120801-253.el8_1.ppc64le.rpm SHA-256: 220328e3848dab762c31322385e519b1beb3871a111a22e583339fe3a940962d
ksh-debuginfo-20120801-253.el8_1.ppc64le.rpm SHA-256: b63fe052609770976a4595ab59ddd07f43355e2e8c01b856c738bf7bfd586cbc
ksh-debugsource-20120801-253.el8_1.ppc64le.rpm SHA-256: 9e2aa1f1b33ffe3c7f2dcc927b3eff5096d97f9ff5124ce1487832b51d052d87

Red Hat Enterprise Linux for ARM 64 8

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
aarch64
ksh-20120801-253.el8_1.aarch64.rpm SHA-256: b4787385391edb6413e5eb9bb2d681654b4b2abc4dee9c148f83212438df1347
ksh-debuginfo-20120801-253.el8_1.aarch64.rpm SHA-256: 8b634e57187bb637ef75275c3198257590106476c08103f2c0da7fa318d60254
ksh-debugsource-20120801-253.el8_1.aarch64.rpm SHA-256: fdf1a79937e8f979aad58e6fdbb532c5b31955385a6bf6ebfcfc2cf90ffb3201

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
aarch64
ksh-20120801-253.el8_1.aarch64.rpm SHA-256: b4787385391edb6413e5eb9bb2d681654b4b2abc4dee9c148f83212438df1347
ksh-debuginfo-20120801-253.el8_1.aarch64.rpm SHA-256: 8b634e57187bb637ef75275c3198257590106476c08103f2c0da7fa318d60254
ksh-debugsource-20120801-253.el8_1.aarch64.rpm SHA-256: fdf1a79937e8f979aad58e6fdbb532c5b31955385a6bf6ebfcfc2cf90ffb3201

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
ppc64le
ksh-20120801-253.el8_1.ppc64le.rpm SHA-256: 220328e3848dab762c31322385e519b1beb3871a111a22e583339fe3a940962d
ksh-debuginfo-20120801-253.el8_1.ppc64le.rpm SHA-256: b63fe052609770976a4595ab59ddd07f43355e2e8c01b856c738bf7bfd586cbc
ksh-debugsource-20120801-253.el8_1.ppc64le.rpm SHA-256: 9e2aa1f1b33ffe3c7f2dcc927b3eff5096d97f9ff5124ce1487832b51d052d87

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1

SRPM
ksh-20120801-253.el8_1.src.rpm SHA-256: 7cd5457fd569c96b9be054e98913dc7c3881581f68d3e6da8b402c0db85665ca
x86_64
ksh-20120801-253.el8_1.x86_64.rpm SHA-256: 1b57fc471f16cff00b8acc6a9efc0af0bcc70fa5ce3f6f6bcd65c66583015e31
ksh-debuginfo-20120801-253.el8_1.x86_64.rpm SHA-256: 99d6a334c323ea26cdc7bea00b712da5425db47fe5d89272b7c65e2e03a3dd59
ksh-debugsource-20120801-253.el8_1.x86_64.rpm SHA-256: 705ca071e841f068ef1a75a765fa5e57016bdaa22a360719d219e8c9ea9c76d4

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.