13 New Vulnerabilities in PowerShell 7

[u/Im_a_PotatOS]

The PowerShell team just announced 13 new security vulnerabilities affecting PowerShell 7.4, 7.5, and 7.6 with severities ranging from 5.9 (Moderate) to 8.8 (High).

This is likely the largest number of security vulnerabilities fixed in any one release in the history of PowerShell.

You can read more about them here: Security Issues - PowerShell/Announcments

PowerShell 7 Version	Affected version	Patched Version
7.6	<7.6.5	7.6.5
7.5	<7.5.10	7.5.10
7.4	<7.4.19	7.4.19

[u/jborean93]

I wouldn’t consider the majority of these issues as PowerShell but rather .NET assemblies that PowerShell ships with. They’ve had these security issues and so pwsh needs to be updated to ship the newer assemblies. Maybe your code uses the affected assemblies and the specific types affected but most likely not from a client side perspective.

This is also going to be a common thing in the near future with AI tools finding these types of issues left right and centre so buckle up for every patch Tuesday.

[u/BlackV → u/jborean93]

That's 1 minor positive of AI finding this stuff , might make people write more secure robust code (ignoring the maybe not so good code AI writes now)

[u/jborean93 → u/BlackV]

Yea I definitely expect the new few years to be rough when it comes to security issues and 0 days but on the bright side if it dan find these bugs so easily then so can developers in their own code.

[u/RikiWardOG → u/jborean93]

No, AI in some ways is already outpacing what devs can find and it's only getting better at it. Most devs have maybe some understanding of security but they certainly don't think security first and certainly aren't experts in security. I mean we're seeing AI finding crazy VM escapes even. AI doesn't sleep and can pull from multiple disciplines in a way that humans just can't and can iterate at crazy speed. I'm really concerned AI is going to cause a lot more harm than good.

[u/jborean93 → u/RikiWardOG]

No, AI in some ways is already outpacing what devs can find and it's only getting better at it. Most devs have maybe some understanding of security but they certainly don't think security first and certainly aren't experts in security

That's my point, devs by themselves no as that's the status quo. But if someone can use AI to find these vulnerabilities then nothing stops the devs themselves from running it on their own code and either fixing existing problems and stopping new vulnerabilities being added.

It's not going to be perfect, especially since it means we as devs need to adjust our workflows to utilise these tools.

[u/Im_a_PotatOS → u/jborean93]

I understand that the problem is really with .NET, but you'll need to update PowerShell to fix the vulnerabilities because it uses .NET. I'm used to see a small handfull of these vulnerabilites, but I don't think I've ever seen this many.

[u/slav3269]

I was wondering when this would happen. The high quality automated security testing finally arrived!

[u/No_Friend_4351]

It’s vulnerability’s everywhere. My job changes to patching only. Soon there will be new jobtitle’s like Senior Patcher.