[Secure-testing-team] Bug#856479: srst2: insecure handling of system calls

[Andreas Tille]

Package: srst2
Version: 0.2.0-3
Severity: grave
Tags: patch security
Justification: user security hole

Hi,

srst2 uses os.popen with unquotet strings allowing users to inject
system calls by preparing specifically designed fasta sequence names
containing '(', ')', ';' characters and others.

A patch fixing this is just in packaging SVN and will be uploaded
right after the bug is published.

Kind regards

      Andreas.

-- System Information:
Debian Release: 8.7
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)