Bug 176324
Summary: | Logwatch http regex period escaping | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | Red Hat Enterprise Linux 4 | Reporter: | Dan Collis-Puro <dan> | ||||||
Component: | logwatch | Assignee: | Ivana Varekova <varekova> | ||||||
Status: | CLOSED ERRATA | QA Contact: | |||||||
Severity: | medium | Docs Contact: | |||||||
Priority: | medium | ||||||||
Version: | 4.0 | ||||||||
Target Milestone: | --- | ||||||||
Target Release: | --- | ||||||||
Hardware: | i686 | ||||||||
OS: | Linux | ||||||||
Whiteboard: | |||||||||
Fixed In Version: | RHBA-2006-0631 | Doc Type: | Bug Fix | ||||||
Doc Text: | Story Points: | --- | |||||||
Clone Of: | Environment: | ||||||||
Last Closed: | 2006-09-06 13:54:04 UTC | Type: | --- | ||||||
Regression: | --- | Mount Type: | --- | ||||||
Documentation: | --- | CRM: | |||||||
Verified Versions: | Category: | --- | |||||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
Cloudforms Team: | --- | Target Upstream Version: | |||||||
Embargoed: | |||||||||
Bug Depends On: | |||||||||
Bug Blocks: | 189992, 201655 | ||||||||
Attachments: |
|
Description
Dan Collis-Puro
2005-12-21 14:20:14 UTC
Created attachment 122518 [details]
proposed patch
Thank you for your notice. The attached patch fixes this problem.
Excellent, that fixes the directory traversal patterns. BUT- every period on every pattern in the @exploits array should be escaped to be thorough- "cmd.exe" probably isn't meant to match "cmd4exe", "cmdtexe" or "cmd/exe", all of which would get matched because the period on the "cmd.exe" pattern isn't escaped. Created attachment 122556 [details] proposed patch (including the patch against problem described in comment 2) Thank you. The attached patch fixes problem desrcibed in comment 2 too. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2006-0631.html |