Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

fix(security): remove command test execution - CVE 2019-16405 #7864

Merged
merged 11 commits into from
Oct 2, 2019

Conversation

lpinsivy
Copy link
Contributor

@lpinsivy lpinsivy commented Sep 23, 2019

Description

  • Remove command test execution
  • Remove dead code
  • Apply sanitize on arguments
  • Use camel case
  • Use PDO:bindParam

Fixes CVE 2019-16405, thank to TheCyberGeek and Khaled

Type of change

  • Patch fixing an issue (non-breaking change)
  • New functionality (non-breaking change)
  • Breaking change (patch or feature) that might cause side effects breaking part of the Software
  • Updating documentation (missing information, typo...)

Target serie

  • 2.8.x
  • 18.10.x
  • 19.04.x
  • 19.10.x (master)

Checklist

Community contributors & Centreon team

  • I followed the coding style guidelines provided by Centreon
  • I have commented my code, especially new classes, functions or any legacy code modified. (docblock)
  • I have commented my code, especially hard-to-understand areas of the PR.
  • I have made corresponding changes to the documentation.
  • I have rebased my development branch on the base branch (master, maintenance).

Centreon team only

  • I have made sure that the unit tests related to the story are successful.
  • I have made sure that unit tests cover 80% of the code written for the story.
  • I have made sure that acceptance tests related to the story are successful (local and CI)

@kduret
Copy link
Contributor

kduret commented Sep 24, 2019

Furthermore, this is not cherry-pickable on 2.8.x cause usage of bindParam and ??

@lpinsivy
Copy link
Contributor Author

I will made another one for 2.8.x

@lpinsivy lpinsivy requested a review from kduret September 24, 2019 08:08
@adr-mo adr-mo requested a review from sc979 September 24, 2019 08:47
@sc979 sc979 force-pushed the MON-4144-remove-commands-testing branch from 1d9c100 to 89c7d89 Compare September 24, 2019 12:06
@lpinsivy lpinsivy merged commit 85d48d3 into master Oct 2, 2019
@lpinsivy lpinsivy deleted the MON-4144-remove-commands-testing branch October 2, 2019 15:14
lpinsivy added a commit that referenced this pull request Oct 2, 2019
* fix(security): remove command test execution - CVE 2019-16405
lpinsivy added a commit that referenced this pull request Oct 2, 2019
* fix(security): remove command test execution - CVE 2019-16405
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants