Bug 1570203

Summary:	python-oslo-rootwrap: IpNetnsExecFilter bypass in CommandFilter function
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, apevec, chrisw, gchamoul, jjoyce, jschluet, kbasil, lhh, lpeer, markmc, mburns, mrunge, rbryant, sclewis, security-response-team, slinaber, srevivo, tdecacqu, vstinner
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-05-28 11:21:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1570204

Description Laura Pardo 2018-04-20 22:13:17 UTC

A flaw was found in Oslo Rootwrap CommandFilter function. IpNetnsExecFilter can be bypassed when an specific filter is enabled this could allow arbitrary code execution

Comment 1 Victor Stinner 2018-04-21 08:36:00 UTC

Hum, am I supposed to do anything?

Comment 2 Joshua Padman 2018-04-27 04:19:59 UTC

Upstream have made the bug public:
https://bugs.launchpad.net/oslo.rootwrap/+bug/1765734

Comment 3 Joshua Padman 2018-04-27 04:20:06 UTC

Acknowledgments:

Name: Daniel Alvarez (Red Hat)

Comment 4 Joshua Padman 2018-05-28 11:21:08 UTC

This has been treated as a hardening issue upstream and likewise here. The issue, which is not considered a vulnerability, will be fixed as features are pulled in from upstream.