Bug 1347180
| Summary: | Arbitrary code execution due to insecure loading of Python module(s) from CWD | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Dhiru Kholia <dkholia> |
| Component: | initial-setup | Assignee: | Martin Kolman <mkolman> |
| Status: | CLOSED WONTFIX | QA Contact: | Release Test Team <release-test-team-automation> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | ||
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-12-15 07:42:12 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1348410 | ||
I'll note that after 7.2 GA the Initial Setup executables have been moved - they are no longer in PATH and are located in /usr/libexec/: /usr/libexec/initial-setup/firstboot-windowmanager /usr/libexec/initial-setup/initial-setup-text /usr/libexec/initial-setup/reconfiguration-mode-enabled /usr/libexec/initial-setup/run-initial-setup /usr/libexec/initial-setup/text-service-is-deprecated After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. |
Description of problem: The /usr/bin/initial-setup script from the initial-setup package tries to load the "initial_setup" Python module from the current working directory (CWD). Steps to Reproduce: $ cat > initial_setup.py print("boom!") $ initial-setup # run /usr/bin/initial-setup ... boom! Additional info: This bug is similar to https://bugzilla.redhat.com/show_bug.cgi?id=995060