Bug 31520

Summary: db2XXX scripts have unsecure parameter passing
Product: [Retired] Red Hat Raw Hide Reporter: matti aarnio <matti.aarnio>
Component: docbook-utilsAssignee: Tim Waugh <twaugh>
Status: CLOSED RAWHIDE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 1.0Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2001-03-12 17:08:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description matti aarnio 2001-03-12 17:04:06 UTC 
package: docbook-utils-0.6-11

The  db2pdf(*),  db2dvi, db2ps, and db2rtf are all of
style:

#! /bin/sh
jw -f docbook -b rtf $*

while they should be:

#! /bin/sh
jw -f docbook -b rtf "$*"

in case any of the passed options have IFS characters in them...

(*) The db2pdf is at package  docbook-utils-pdf  which isn't listed at RH
component dataset.
Comment 1 Tim Waugh 2001-03-12 17:08:38 UTC 
(ITYM "$@".)  Thanks for spotting it.
Comment 2 Tim Waugh 2001-03-12 18:42:38 UTC 
Fixed in docbook-utils-0.6-12 in rawhide, although I don't think it's really a 
security issue.