Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

add escapeshellarg to nagios_bin binary passed to shell_exec #7694

Merged
merged 3 commits into from
Jul 15, 2019

Conversation

sc979
Copy link
Contributor

@sc979 sc979 commented Jul 10, 2019

Pull Request Template

Description

From @mhaskar 's PR https://github.com/centreon/centreon/pull/7663 -> rebased and conflict resolved.
PR already reviewed !

To be cherry-picked on the 18.10.x and 19.04.x branches after QA validation. For 2.8.x, an other PR is needed.

https://shells.systems/centreon-v19-04-remote-code-execution-cve-2019-13024

Fixes # (CVE)

Type of change

  • Patch fixing an issue (non-breaking change)
  • New functionality (non-breaking change)
  • Breaking change (patch or feature) that might cause side effects breaking part of the Software
  • Updating documentation (missing information, typo...)

Target serie

  • 2.8.x -> other PR
  • 18.10.x
  • 19.04.x
  • 19.10.x (master)

How this pull request can be tested ?

Please describe the procedure to verify that the goal of the PR is matched. Provide clear instructions so that it can be correctly tested.

Any relevant details of the configuration to perform the test should be added.

Checklist

Community contributors & Centreon team

  • I followed the coding style guidelines provided by Centreon
  • I have commented my code, especially new classes, functions or any legacy code modified. (docblock)
  • I have commented my code, especially hard-to-understand areas of the PR.
  • I have made corresponding changes to the documentation.
  • I have rebased my development branch on the base branch (master, maintenance).

Centreon team only

  • I have made sure that the unit tests related to the story are successful.
  • I have made sure that unit tests cover 80% of the code written for the story.
  • I have made sure that acceptance tests related to the story are successful (local and CI)

@sc979 sc979 added kind/security status/in-backlog A dev will begin to work on your modifications soon labels Jul 10, 2019
Copy link
Contributor

@kduret kduret left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sorry for that, but even if it's a cherry-pick, could you split it in 2 lines to avoid to exceed 120 characters ?

Copy link
Contributor

@vhr vhr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just suggestions

@sc979 sc979 force-pushed the MON-3968-escape-nagios-path-and-poller-id-master branch from f5c81d9 to a39c6d9 Compare July 11, 2019 13:36
@sc979 sc979 force-pushed the MON-3968-escape-nagios-path-and-poller-id-master branch from a39c6d9 to f445601 Compare July 12, 2019 07:53
@sc979 sc979 merged commit d27f53a into master Jul 15, 2019
sc979 added a commit that referenced this pull request Jul 15, 2019
sc979 added a commit that referenced this pull request Jul 15, 2019
sc979 added a commit that referenced this pull request Jul 15, 2019
@sc979
Copy link
Contributor Author

sc979 commented Jul 15, 2019

Succesfully cherry-picked on the branches :

  • 19.04.x
  • 18.10.x
  • 2.8.x -> with conflicts resolution or adaptation

@sc979 sc979 deleted the MON-3968-escape-nagios-path-and-poller-id-master branch July 15, 2019 07:59
lpinsivy pushed a commit that referenced this pull request Jul 15, 2019
lpinsivy pushed a commit that referenced this pull request Jul 15, 2019
sc979 added a commit that referenced this pull request Jul 18, 2019
sc979 added a commit that referenced this pull request Jul 18, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
status/in-backlog A dev will begin to work on your modifications soon
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants