Projects
openEuler:20.03:LTS:SP3
ansible
_service:tar_scm_kernel_repo:CVE-2019-14904.patch
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm_kernel_repo:CVE-2019-14904.patch of Package ansible
From e5a2138219d497491d2a7e07ba558737548f0e69 Mon Sep 17 00:00:00 2001 From: Abhijeet Kasurde <akasurde@redhat.com> Date: Tue, 10 Dec 2019 16:58:37 +0530 Subject: [PATCH] solaris_zone: Allow only valid characters in zone name CVE-2019-14904 - solaris_zone module accepts zone name and performs actions related to that. However, there is no user input validation done while performing actions. A malicious user could provide a crafted zone name which allows executing commands into the server manipulating the module behaviour. Adding user input validation as per Solaris Zone documentation fixes this issue. Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> --- changelogs/fragments/solaris_zone_name_fix.yml | 5 +++++ lib/ansible/modules/system/solaris_zone.py | 10 ++++++++++ 2 files changed, 15 insertions(+) create mode 100644 changelogs/fragments/solaris_zone_name_fix.yml diff --git a/changelogs/fragments/solaris_zone_name_fix.yml b/changelogs/fragments/solaris_zone_name_fix.yml new file mode 100644 index 0000000..eea9785 --- /dev/null +++ b/changelogs/fragments/solaris_zone_name_fix.yml @@ -0,0 +1,5 @@ +bugfixes: +- "**SECURITY** - CVE-2019-14904 - solaris_zone module accepts zone name and performs actions related to that. + However, there is no user input validation done while performing actions. A malicious user could provide a + crafted zone name which allows executing commands into the server manipulating the module behaviour. Adding + user input validation as per Solaris Zone documentation fixes this issue." diff --git a/lib/ansible/modules/system/solaris_zone.py b/lib/ansible/modules/system/solaris_zone.py index bbeb803..2cb76ec 100644 --- a/lib/ansible/modules/system/solaris_zone.py +++ b/lib/ansible/modules/system/solaris_zone.py @@ -41,6 +41,10 @@ options: name: description: - Zone name. + - A zone name must be unique name. + - A zone name must begin with an alpha-numeric character. + - The name can contain alpha-numeric characters, underbars I(_), hyphens I(-), and periods I(.). + - The name cannot be longer than 64 characters. required: true path: description: @@ -137,6 +141,7 @@ EXAMPLES = ''' import os import platform +import re import tempfile import time @@ -173,6 +178,11 @@ class Zone(object): if int(self.os_minor) < 10: self.module.fail_json(msg='This module requires Solaris 10 or later') + match = re.match('^[a-zA-Z0-9][-_.a-zA-Z0-9]{0,62}$', self.name) + if not match: + self.module.fail_json(msg="Provided zone name is not a valid zone name. " + "Please refer documentation for correct zone name specifications.") + def configure(self): if not self.path: self.module.fail_json(msg='Missing required argument: path') -- 2.27.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.