|
From: Xavier D. v. lists.hpsf.i. <xav...@li...> - 2026-09-07 05:37:09
|
Hello All, Modules 5.6.2, 5.3.2 and 4.5.4 are out. These releases fix a security vulnerability in the Bash completion script of the module and ml commands (CVE-2026-85013). Module names used as completion candidates were passed unfiltered to the Bash compgen builtin, which evaluates command substitution syntax. A local attacker able to place a maliciously named modulefile in a directory visible in the victim's MODULEPATH could execute arbitrary commands as the victim when they trigger Bash completion on module or ml. Only the Bash completion script is affected: the modulecmd.tcl engine and the completion scripts of the other shells are not vulnerable. All versions from 3.2.7 to 5.6.1 are affected. Fixed versions are: - 5.6.2 for the 5.4.0 - 5.6.1 series - 5.3.2 for the 4.6.0 - 5.3.1 series - 4.5.4 for the 3.2.7 - 4.5.3 series Full details are provided in the security advisory: https://github.com/envmodules/modules/security/advisories/GHSA-8hrw-p88g-qhmg If upgrading is not immediately possible, the fixed Bash completion script can be installed on its own, as the fix only touches this file. As an interim workaround, Bash completion for module and ml can be disabled by removing the completion script from the Bash completion directory. The changes introduced in these bugfix releases are detailed at: https://modules.readthedocs.io/en/stable/NEWS.html#modules-5-6-2-2026-09-07 The tarballs of these new versions can be downloaded at: https://github.com/envmodules/modules/releases/download/v5.6.2/modules-5.6.2.tar.gz https://github.com/envmodules/modules/releases/download/v5.3.2/modules-5.3.2.tar.gz https://github.com/envmodules/modules/releases/download/v4.5.4/modules-4.5.4.tar.gz The zipball to install the new versions on Windows platform can be downloaded at: https://github.com/envmodules/modules/releases/download/v5.6.2/modules-5.6.2-win.zip https://github.com/envmodules/modules/releases/download/v5.3.2/modules-5.3.2-win.zip https://github.com/envmodules/modules/releases/download/v4.5.4/modules-4.5.4-win.zip If you encounter any issue, please let us know by creating a ticket on the project bug tracker at: https://github.com/envmodules/modules/issues Security issues should be reported privately, as described in the project security policy: https://github.com/envmodules/modules/blob/main/SECURITY.md Special thanks to AISLE and Red Hat who found and reported this vulnerability. Best regards, Xavier -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#49): https://lists.hpsf.io/g/modules-interest/message/49 Mute This Topic: https://lists.hpsf.io/mt/121124889/10150481 Group Owner: mod...@li... Unsubscribe: https://lists.hpsf.io/g/modules-interest/unsub [mod...@li...] -=-=-=-=-=-=-=-=-=-=-=- |
