Cobbler command injection vulnerability (CVE-2017-1000469)

[Adam Heczko]

Detailed bug description:

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.

Fuel node ships with Cobbler used for cloud deployment purposes. Although Cobber API is not intended to use over the network in Fuel use case we need to provide updated Cobbler packages.

https://github.com/cobbler/cobbler/issues/1845

[Alexander Rubtsov (arubtsov)]

sla2 for 9.0-updates

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: 9.0
Change author: Denis V. Meltsaykin <email address hidden>
Review: https://review.fuel-infra.org/37796

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/37796
Submitter: Pkgs Jenkins <email address hidden>
Branch: 9.0

Commit: f56dde23ea494dc74aaef674b66e05a971974fc2
Author: Denis V. Meltsaykin <email address hidden>
Date: Tue Feb 6 16:19:47 2018

Fix for cve-2017-1000469

Since cobbler uses shell when calling external commands it's needed
to wrap arguments so shell doesn't treat them as separate commands.

Change-Id: I04f7438abcab12d77f04e697e20c49cb2d7d38b7
Closes-Bug: #1742098

[Vladimir Jigulin (vjigulin)]

Verified on 9.2-mu-5 (proposed):
/usr/lib/python2.7/site-packages/cobbler/action_reposync.py file patched