Ubuntu
landscape-client package

Potential arbitrary execution in expandvars

Bug #2055348 reported by Mitch Burton
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
landscape-client (Ubuntu)
Fix Released
High
Mitch Burton

Bug Description

landscape.lib.format.expandvars expands variables by executing bash in a subprocess. This has the potential for executing arbitrary shell commands, e.g., if the variable is $(rm -rf /home/*).

This function is currently only executed using values defined in Ubuntu Core configuration, but this is still an external source and we should do shell-like expansion in a way that does not allow for execution of the user-provided values.

Related branches

~mitchburton/ubuntu/+source/landscape-client:2055348-fix-expandvars-arb-exec
Andreas Hasenack: Approve
Diff: 115 lines (+95/-0)
3 files modified
debian/changelog (+7/-0)
debian/patches/2055348-fix-expandvars-arb-exec.patch (+87/-0)
debian/patches/series (+1/-0)
Andreas Hasenack (ahasenack)
Changed in landscape-client (Ubuntu):
importance: Undecided → High
Revision history for this message
Mitch Burton (mitchburton) wrote :

Upstream replacement with python here: https://github.com/canonical/landscape-client/pull/222
Will produce patch.

Changed in landscape-client (Ubuntu):
assignee: nobody → Mitch Burton (mitchburton)
Mitch Burton (mitchburton)
Changed in landscape-client (Ubuntu):
status: New → In Progress
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package landscape-client - 24.02-0ubuntu2

---------------
landscape-client (24.02-0ubuntu2) noble; urgency=medium

  * d/p/2055348-fix-expandvars-arb-exec.patch: fix potential arbitrary shell
    execution in landscape/lib/format.py:expandvars (LP: #2055348)

 -- Mitch Burton <email address hidden> Thu, 29 Feb 2024 10:23:23 -0800

Changed in landscape-client (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.