Package: srst2
Version: 0.2.0-3
Severity: grave
Tags: patch security
Justification: user security hole
Hi,
srst2 uses os.popen with unquotet strings allowing users to inject
system calls by preparing specifically designed fasta sequence names
containing '(', ')', ';' characters and others.
A patch fixing this is just in packaging SVN and will be uploaded
right after the bug is published.
Kind regards
Andreas.
-- System Information:
Debian Release: 8.7
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.16.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
