Securing Internet-Critical Software: How We Could Have Backdoored Bash

Security researchers at Hacktron discovered multiple critical vulnerabilities in Savane, the PHP application powering the GNU Savannah code hosting platform. The flaws included a command injection vulnerability in the GPG key testing feature via maliciously crafted email addresses, which allowed unauthenticated remote code execution and subsequent escalation to superuser, maintainer impersonation, and root access. Open article →