Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux

guest · Apr 25, 2021

Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux
April 24, 2021
https://thehackernews.com/2021/04/critical-rce-bug-found-in-homebrew.html

A recently identified security vulnerability in the official Homebrew Cask repository could have been exploited by an attacker to execute arbitrary code on users' machines that have Homebrew installed.

The issue, which was reported to the maintainers on April 18 by a Japanese security researcher named RyotaK, stemmed from the way code changes in its GitHub repository were handled, resulting in a scenario where a malicious pull request — i.e., the proposed changes — could be automatically reviewed and approved. The flaw was fixed on April 19.

"The discovered vulnerability would allow an attacker to inject arbitrary code into a cask and have it be merged automatically," Homebrew's Markus Reiter said. "
Click to expand...

In other words, the flaw meant malicious code injected into the Cask repository was merged without any review and approval.
Click to expand...

Log in or Sign up

Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux

guest Guest

Log in or Sign up

Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux

guest Guest

Useful Searches