8000 [3.7] gh-97612: Fix shell injection in get-remote-certificate.py (#97613) by vstinner · Pull Request #97634 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

[3.7] gh-97612: Fix shell injection in get-remote-certificate.py (#97613) #97634

8000
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Oct 5, 2022
Merged

[3.7] gh-97612: Fix shell injection in get-remote-certificate.py (#97613) #97634

merged 1 commit into from
Oct 5, 2022

Conversation

vstinner
Copy link
Member
@vstinner vstinner commented Sep 28, 2022 •
edited by bedevere-bot
Loading

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt caleb@rgauge.com
(cherry picked from commit 83a0f44)

@vstinner @calebshortt
gh-97612: Fix shell injection in get-remote-certificate.py (#97613)
aeb5324 
Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <caleb@rgauge.com>
(cherry picked from commit 83a0f44)
@bedevere-bot bedevere-bot added the type-security A security issue label Sep 28, 2022
@bedevere-bot bedevere-bot mentioned this pull request Sep 28, 2022
Merged
@vstinner
Copy link
Member Author

Unrelated to this PR: test_int fails randomly on Windows x64:

FAIL: test_denial_of_service_prevented_str_to_int (test.test_int.IntSubclassStrDigitLimitsTests)
Regression test: ensure we fail before performing O(N**2) work.
----------------------------------------------------------------------
Traceback (most recent call last):
  File "D:\a\cpython\cpython\lib\test\test_int.py", line 654, in test_denial_of_service_prevented_str_to_int
    self.assertLess(seconds_to_fail_extra_huge, seconds_to_convert/8)
AssertionError: 0.015625 not less than 0.013671875

I re-run the job.

@ambv ambv merged commit c7ec780 into python:3.7 Oct 5, 2022
@vstinner vstinner deleted the get_certs37 branch December 13, 2022 15:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
type-security A security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@vstinner @ambv @bedevere-bot
0