Arbitrary file write vulnerability in GNU gzip's zgrep utility

Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by foota on Monday April 18, 2022 @06:27PM (#31077445)

The thought of writing anything in sh is horrifying to me.

[ Parent | on HN ]

Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by djbusby on Monday April 18, 2022 @07:46PM (#31078184)

Check out GNU pass

It's like all sh

[ Parent | on HN ]

Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by 0xdeadb00f on Monday April 18, 2022 @08:22PM (#31078419)

I didn't know pass was "GNU". I also recall it being pretty well written.

[ Parent | on HN ]

Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by guns on Monday April 18, 2022 @10:02PM (#31079089)

Original author of password-store was Jason Donenfeld (of Wireguard fame), and it was indeed well-written.

[ Parent | on HN ]

Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by 0xdeadb00f on Monday April 18, 2022 @10:05PM (#31079105)

Yes! Actually I remember now being surprised to find out Jason had written it. His git repository is full of neat and interesting projects.

[ Parent | on HN ]

Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by loudmax on Tuesday April 19, 2022 @08:42AM (#31082318)

Pass is a wrapper script around git and gpg. You can get the functionality of `pass` by running git and gpg commands directly.

Learning git itself is non-intuitive, but the gpg utilities take the learning curve to a whole other level. If you want to make simple use of the gpg utilities, you should plan on setting aside a few full days to learn how they work. Or just use pass, which additionally leverages git for password history.

[ Parent | on HN ]

Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by scbrg on Tuesday April 19, 2022 @09:06AM (#31082556)

bash, actually.

[ Parent | on HN ]