CVE Request: OS Command Injection in brona/iproute2mac (Fixed in v1.7.5)

**1. Vulnerability Overview**
I am requesting a CVE for an OS Command Injection vulnerability (CWE-78) discovered in the `iproute2mac` project. The flaw allowed an attacker to execute arbitrary system commands by manipulating command-line arguments passed to the `ip link show` functionality.

**2. Technical Details**
* **Component:** `ip` command handler (`iproute2mac.py`)
* **Root Cause:** User-controlled input from `sys.argv` was concatenated directly into a string passed to `subprocess.getstatusoutput()`. Because this function inherently spawns a shell (`shell=True`), an attacker could break out of the intended command context using shell metacharacters (e.g., `;`, `&&`).
* **Attack Vector:** Local execution (e.g., `ip link show "eth0; id"`)

**3. Impact**
While this is a local CLI tool, arbitrary command injection via argument manipulation is a severe security boundary violation. If this tool is invoked by a secondary application or script processing untrusted input, it leads directly to Remote Code Execution (RCE).

**4. Resolution**
* The maintainer acknowledged the report promptly and pushed a fix in commit `d31140b`.
* The fix migrated the unsafe `subprocess.getstatusoutput()` to `subprocess.run()` with argument arrays, eliminating the shell injection vector.
* The patch was officially released in `v1.7.5`.

**5. CVE Request Justification**
I am submitting this request independently, with the awareness of the maintainer's patch. Assigning a CVE provides a standardized identifier for downstream consumers to track this security fix in their dependency management and vulnerability scanners.

**6. References**
* Original Issue: https://github.com/brona/iproute2mac/issues/80
* Fix Commit: https://github.com/brona/iproute2mac/commit/d31140b
* Fixed Release: https://github.com/brona/iproute2mac/releases/tag/v1.7.5

The relevant component is iproute2mac.py's ip command handler, with the described fix in commit d31140b and release v1.7.5. Start by checking the referenced original issue and fix commit; this request is complete only if a CVE is assigned and downstream users can associate it with v1.7.5.

Scritto dal modello di indicizzazione a partire dal testo della issue.