4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7259-cwhx-3xx3

GHSA-7259-cwhx-3xx3: Duplicate Advisory: uutils coreutils has an Improper Check for Unusual or Exceptional Conditions

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-p7h3-7q52-72w8. This link is maintained to preserve external references.

Original Description

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7259-cwhx-3xx3

GHSA-7259-cwhx-3xx3:

4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
coreutils	rust	< 0.6.0	0.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the printenv utility of uutils/coreutils, specifically within the uumain function. The root cause is an improper assumption that environment variables will always be valid UTF-8. The original implementation used Rust's env::vars() function, which filters out any environment variables that are not valid UTF-8 strings. This behavior creates a security blind spot. An attacker can set a malicious environment variable, such as LD_PRELOAD, with a value containing invalid UTF-8 bytes. While the printenv utility would fail to display this variable, the underlying operating system and dynamic linker would still process it, potentially leading to code injection or other attacks. The fix, implemented in commit 0bfbbc00c7895c0fb6ea94987b4aab99e3d7ee52, involves switching to env::vars_os() and env::var_os(). These functions treat environment variables as OsStrings, which can handle arbitrary byte sequences. The patched code then writes the raw bytes of the variable names and values to the standard output, ensuring that all environment variables are visible, thus closing the information disclosure gap.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.