Skip to content

[security] Tools/scripts/get-remote-certificate.py is vulnerable to shell code injection #97612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
vstinner opened this issue Sep 28, 2022 · 3 comments
Closed

[security] Tools/scripts/get-remote-certificate.py is vulnerable to shell code injection #97612

vstinner opened this issue Sep 28, 2022 · 3 comments
Labels
type-bug An unexpected behavior, bug, or error type-security A security issue

Comments

@vstinner
Copy link
Member

vstinner commented Sep 28, 2022 •
edited
Loading

The Tools/scripts/get-remote-certificate.py script is vulnerable to shell code injection. This vulnerability was reported by Caleb Shortt (@calebshortt).

@calebshortt proposed PR #96014 to fix it.
@vstinner vstinner added type-bug An unexpected behavior, bug, or error type-security A security issue labels Sep 28, 2022
@vstinner
Copy link
Member Author

Example:

$ ./python Tools/scripts/get-remote-certificate.py 'localhost"||echo 1 > /tmp/marker #:80'
(...)

$ cat /tmp/marker 
1

@vstinner vstinner changed the title [security][CVE-2022-37460] Tools/scripts/get-remote-certificate.py is vulnerable to shell code injection [security] Tools/scripts/get-remote-certificate.py is vulnerable to shell code injection Sep 28, 2022
@vstinner
Copy link
Member Author

I removed mention of CVE-2022-37460: it was withdrawn according to @gpshead.

@bedevere-bot bedevere-bot mentioned this issue Sep 28, 2022
Merged
vstinner added a commit that referenced this issue Sep 28, 2022
@vstinner @calebshortt
gh-97612: Fix shell injection in get-remote-certificate.py (#97613)
83a0f44 
Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Sep 28, 2022
@vstinner @miss-islington
pythongh-97612: Fix shell injection in get-remote-certificate.py (pyt…
0edc084 
…honGH-97613)

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)

Co-authored-by: Victor Stinner <[email protected]>
@bedevere-bot bedevere-bot mentioned this issue Sep 28, 2022
Merged
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Sep 28, 2022
@vstinner @miss-islington
pythongh-97612: Fix shell injection in get-remote-certificate.py (pyt…
c61364e 
…honGH-97613)

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)

Co-authored-by: Victor Stinner <[email protected]>
@bedevere-bot bedevere-bot mentioned this issue Sep 28, 2022
Merged
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Sep 28, 2022
@vstinner @miss-islington
pythongh-97612: Fix shell injection in get-remote-certificate.py (pyt…
a40a0ba 
…honGH-97613)

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)

Co-authored-by: Victor Stinner <[email protected]>
@bedevere-bot bedevere-bot mentioned this issue Sep 28, 2022
Merged
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Sep 28, 2022
@vstinner @miss-islington
pythongh-97612: Fix shell injection in get-remote-certificate.py (pyt…
e00b8f2 
…honGH-97613)

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)

Co-authored-by: Victor Stinner <[email protected]>
This was referenced Sep 28, 2022
Merged
Merged
miss-islington added a commit that referenced this issue Sep 28, 2022
@miss-islington @vstinner
gh-97612: Fix shell injection in get-remote-certificate.py (GH-97613)
94582bb 
Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)

Co-authored-by: Victor Stinner <[email protected]>
miss-islington added a commit that referenced this issue Sep 28, 2022
@miss-islington @vstinner
gh-97612: Fix shell injection in get-remote-certificate.py (GH-97613)
e3815d7 
Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)

Co-authored-by: Victor Stinner <[email protected]>
@vstinner
Copy link
Member Author

I created https://discuss.python.org/t/remove-outdated-tools-scripts-scripts/19571 discussion to propose removing outdated example scripts.

ambv pushed a commit that referenced this issue Oct 4, 2022
@miss-islington @vstinner
[3.9] gh-97612: Fix shell injection in get-remote-certificate.py (GH-…
d6ef680 
…97613) (GH-97632)

gh-97612: Fix shell injection in get-remote-certificate.py (GH-97613)

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)

Co-authored-by: Victor Stinner <[email protected]>
ambv pushed a commit that referenced this issue Oct 4, 2022
@miss-islington @vstinner
[3.8] gh-97612: Fix shell injection in get-remote-certificate.py (GH-…
9062049 
…97613) (GH-97633)

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)

Co-authored-by: Victor Stinner <[email protected]>
ambv pushed a commit that referenced this issue Oct 5, 2022
@vstinner @calebshortt
[3.7] gh-97612: Fix shell injection in get-remote-certificate.py (#97613
c7ec780 
) (#97634)

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)
@vstinner vstinner closed this as completed Oct 6, 2022
@CamberLoid CamberLoid mentioned this issue Nov 22, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type-bug An unexpected behavior, bug, or error type-security A security issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@vstinner