Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[3.7] gh-97612: Fix shell injection in get-remote-certificate.py (#97613) #97634

Open
wants to merge 1 commit into
base: 3.7
Choose a base branch
from
Open

[3.7] gh-97612: Fix shell injection in get-remote-certificate.py (#97613) #97634

wants to merge 1 commit into from
+10 −19

Conversation

vstinner
Copy link
Member

@vstinner vstinner commented Sep 28, 2022 •
edited by bedevere-bot

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt caleb@rgauge.com
(cherry picked from commit 83a0f44)

@vstinner
pythongh-97612: Fix shell injection in get-remote-certificate.py (pyt…
aeb5324 
…hon#97613)

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <caleb@rgauge.com>
(cherry picked from commit 83a0f44)
@bedevere-bot bedevere-bot added the type-security A security issue label Sep 28, 2022
@bedevere-bot bedevere-bot mentioned this pull request Sep 28, 2022
Merged
@vstinner
Copy link
Member Author

vstinner commented Sep 29, 2022

Unrelated to this PR: test_int fails randomly on Windows x64:

FAIL: test_denial_of_service_prevented_str_to_int (test.test_int.IntSubclassStrDigitLimitsTests)
Regression test: ensure we fail before performing O(N**2) work.
----------------------------------------------------------------------
Traceback (most recent call last):
  File "D:\a\cpython\cpython\lib\test\test_int.py", line 654, in test_denial_of_service_prevented_str_to_int
    self.assertLess(seconds_to_fail_extra_huge, seconds_to_convert/8)
AssertionError: 0.015625 not less than 0.013671875

I re-run the job.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
awaiting core review type-security A security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@vstinner @bedevere-bot