Headline

Gentoo Linux Security Advisory 202401-07

Gentoo Linux Security Advisory 202401-7 - A vulnerability was found in R which could allow for remote code execution. Versions greater than or equal to 4.0.4 are affected.

10 months ago

Packet Storm

Open in Source

#vulnerability #web #mac #linux #c++#rce #auth

Gentoo Linux Security Advisory GLSA 202401-07

                                       https://security.gentoo.org/

Severity: Normal
Title: R: Directory Traversal
Date: January 06, 2024
Bugs: #765361
ID: 202401-07

Synopsis

A vulnerability was found in R which could allow for remote code
execution.

Background

R is a language and environment for statistical computing and graphics.

Affected packages

Package Vulnerable Unaffected

dev-lang/R < 4.0.4 >= 4.0.4

Description

The native R package installation mechanisms do not sufficiently
validate installed source packages for path traversal.

Impact

Installation of a malicious R package could result in an arbitrary file
overwrite which could result in arbitrary code execution, as might be
seen with the overwrite of an authorized_keys file.

Workaround

There is no known workaround at this time.

Resolution

All R users should upgrade to the latest version:

emerge --sync

emerge --ask --oneshot --verbose “>=dev-lang/R-4.0.4”

References

[ 1 ] CVE-2020-27637
https://nvd.nist.gov/vuln/detail/CVE-2020-27637
[ 2 ] -fno-common
[ 3 ] gcc-10

Availability

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202401-07

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.