|
Bugzilla – Full Text Bug Listing |
| Summary: | AUDIT-FIND: resource-agents: eval with unsanitized values in heartbeat/db | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Johannes Segitz <jsegitz> |
| Component: | Incidents | Assignee: | Peter Varkoly <varkoly> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Minor | ||
| Priority: | P5 - None | CC: | dakechi, filippo.bonazzi, gianluca.gabrielli, jsegitz, nwang, rfrohl, stoyan.manolov, varkoly |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/240860/ | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Bug Depends on: | |||
| Bug Blocks: | 1021689 | ||
I analyzed the possible expenditure values and found nothing dangerous: https://www.ibm.com/support/knowledgecenter/en/SSEPGG_11.1.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0001954.html Sorry for closing. I wanted to ask if you would agree if I closed the ticket with "worksforme". (In reply to Peter Varkoly from comment #2) I would prefer just removing the eval. Something like HADR_ROLE=$(echo "$output" "awk '/HADR database role/ {printf "HADR_ROLE='%s'; ", $NF;}) (repeat for other values) should do the trick SUSE-SU-2020:1092-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1021689,1146687,1146690,1146691,1146776,1146784,1146785,1146787,1146789,1161898 CVE References: Sources used: SUSE Linux Enterprise High Availability 12-SP3 (src): resource-agents-4.0.1+git.1495055229.643177f1-2.45.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2020:1091-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1021689,1146687,1146690,1146691,1146692,1146766,1146776,1146784,1146785,1146787,1146789 CVE References: Sources used: SUSE Linux Enterprise High Availability 12-SP5 (src): resource-agents-4.3.018.a7fb5035-3.42.1 SUSE Linux Enterprise High Availability 12-SP4 (src): resource-agents-4.3.018.a7fb5035-3.42.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. seems unfixed then PEter, can you clarify where it is fixed and where not? Discussed with upstream and there is no reason to change this script. Hi Peter, This issue is still mentioned in SUSE:SLE-12-SP3:Update/resource-agents/resource-agents.changes:26, but no fix is provided. As you said, I can see that upstream is not fixing this [0]. Could you please create and maintain a patch to enforce this from our side? As Johannes pointed out a long time ago, eval could pose a security risk. [0] https://github.com/ClusterLabs/resource-agents/blob/a0e622d3b1e84833b2d60094abe4818df031d8a8/heartbeat/db2#L323-L331 Please have a look here or ping us if you need further guidance. Thanks (In reply to Johannes Segitz from comment #13) > Please have a look here or ping us if you need further guidance. Thanks Also seems to be missing for SLE-15-SP1. Hi Peter, I don't want to bore you, but there are a couple of things that needs to be clarified here: - If there is a bug that we consider a security risk and no patch is available, then the maintainer needs to write and maintain a patch for all the affected SUSE products. In this case the patch is trivial. - There still are two packages with the wrong changes file: - SUSE:SLE-12-SP3:Update/resource-agents/resource-agents.changes:36 - SUSE:SLE-12-SP3:Update/resource-agents/.osc/resource-agents.changes:36 these needs to be fixed. - Security BZ issues should not be closed by the maintainer, instead reassigned back to security-team@suse.de. This way we can double-check released updates and close the BZ issue only when all the affected packages are fixed. So, please do not close this (or any security related) issue again. I review the currently supported 'resource-agents' packages and the following are all affected by this issue: - SUSE:SLE-11-SP4:Update/resource-agents - SUSE:SLE-12-SP2:Update/resource-agents - SUSE:SLE-12-SP3:Update/resource-agents - SUSE:SLE-12-SP4:Update/resource-agents - SUSE:SLE-15:Update/resource-agents - SUSE:SLE-15-SP1:Update/resource-agents - SUSE:SLE-15-SP2:Update/resource-agents - SUSE:SLE-15-SP3:Update/resource-agents - SUSE:SLE-15-SP4:Update/resource-agents Please write and submit a patch to all of them and fix the two above-mention change files accordingly. If you need any help or guidance, please reach out to Johannes who already offered his help in comment 13. I'll ask upstream again. Is this fixed? Can this be closed? I've created a pull request with the suggested solution: https://github.com/ClusterLabs/resource-agents/pull/1838 I've created a pull request with the suggested solution: https://github.com/ClusterLabs/resource-agents/pull/1838 Thank you Peter, that looks to me like the best solution - we don't have to maintain a patch and we contribute an improvement (however minor) upstream. I'll wait for the PR to be merged upstream and the update to be submitted in OBS before closing this bug. PR#1838 was submitted as part of SR#1060932 currently in Staging. Improved upstream script (PR#1838) has now been accepted into Factory (SR#1060963) and SLE-15-SP5 (SR#288876). Given this is only a hardening, we're happy with the solution being offered in Factory and SLE 15 SP5. There is no need to provide a patch for older SLEs at this time. I am going to close this and the parent bugs. Thank you Peter for all the work. |
resource-agents-4.3.018.a7fb5035/heartbeat/db2 310 output=$(runasdb2 db2 get db cfg for $db) 311 [ $? != 0 ] && return $OCF_ERR_GENERIC 312 313 hadr_vars=$(echo "$output" | 314 awk '/HADR database role/ {printf "HADR_ROLE='%s'; ", $NF;} 315 /HADR_TIMEOUT/ {printf "HADR_TIMEOUT='%s'; ", $NF;} 316 /First active log file/ {printf "FIRST_ACTIVE_LOG='%s'\n", $NF;} 317 /HADR_PEER_WINDOW/ {printf "HADR_PEER_WINDOW='%s'\n", $NF;}') 318 319 320 # sets HADR_ROLE HADR_TIMEOUT HADR_PEER_WINDOW 321 eval $hadr_vars I played around with a bit but I don't have a clue about DB2. So I'm not sure if you can get characters in here that are problematic, but better sanitize than be sorry