critical9.8
CVE-2021-40084
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters.
Impact
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Artixlinux | Opensysusers | through 0.6 |