CVE-2021-45444: Update NEWS/README

(cherry picked from commit bdc4d70a7e033b754e68a8659a037ea0fc5f38de)

1 files changed, 17 insertions, 0 deletions

diff --git a/NEWS b/NEWS
index 3459391e7..1e9926c05 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,23 @@ Note also the list of incompatibilities in the README file.
 Changes since 5.8
 -----------------
 
+CVE-2021-45444: Some prompt expansion sequences, such as %F, support
+'arguments' which are themselves expanded in case they contain colour
+values, etc. This additional expansion would trigger PROMPT_SUBST
+evaluation, if enabled. This could be abused to execute code the user
+didn't expect. e.g., given a certain prompt configuration, an attacker
+could trick a user into executing arbitrary code by having them check
+out a Git branch with a specially crafted name.
+
+This is fixed in the shell itself by no longer performing PROMPT_SUBST
+evaluation on these prompt-expansion arguments.
+
+Users who are concerned about an exploit but unable to update their
+binaries may apply the partial work-around described in the file
+Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell
+source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to
+Marc Cornellà <hello@mcornella.com>. ]
+
 When unsetting a hash element, the string enclosed in square brackets is
 interpreted literally after any normal command-line-argument expansions.
 Thus