Bug 1999680
| Summary: | rsync: command injection on the remote host when copying files | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | unspecified | CC: | aprice, bdettelb, caswilli, cmyers, code, dfreiber, dnakabaa, doconnor, drow, fjansen, jburrell, jdobes, jkoehler, jmitchel, jnakfour, joehler, jsamir, jvasik, kaycoth, kshier, lcouzens, lphiri, luhliari, mruprich, mskarbek, oezr, orabin, pbohmill, psegedy, rblanco, ssorce, teagle, vkumar, vmugicag |
| Target Milestone: | --- | Keywords: | Reopened, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A command injection vulnerability was found in rsync. An attacker can use this vulnerability to execute arbitrary commands on a remote host via arguments passed to rsync for a copy operation. The attacker needs to know the SSH login password to be able to exploit this issue. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-09-01 14:49:05 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1999193, 1999682 | ||
|
Description
Guilherme de Almeida Suckevicz
2021-08-31 14:44:13 UTC
Isn't this yet another duplicate of the plethora of SCP related bugs we've seen in the past? Why is it marked severity High when it requires a user to already have the power to log in via SSH and perform those commands? In reply to comment #1: > Isn't this yet another duplicate of the plethora of SCP related bugs we've > seen in the past? > Why is it marked severity High when it requires a user to already have the > power to log in via SSH and perform those commands? So, I don't believe it's a duplicate based on the bugs I have searched / looked through prior to the request to try and make sure it was not a dupe. While the affect might be similar to some bugs we have seen before, the root cause here is with the rsync program, which hasn't been covered before from what I saw (at least for this type of bug). Of course, I could be wrong as the duplicate info is based on a quick check. In regards to the High severity, I agree that having a password makes it so this is less of an issue. I thought that PR:L would cover this as you certainly don't need access to a root account for this to work, just any account permissions. While I agree that in most reasonable cases, anyone with a password would just perform a normal SSH in anyways, my issue is that the program performs these actions at all. Ideally the program would be unable to perform these actions on behalf of the user and sanitize input commands properly. My reasoning came from the view that a program should not introduce a vulnerability or method of executing unintended actions. Perhaps adjusting to PR:H would be more appropriate? Totally open to a discussion on this, I tend to err on the side of caution so if perhaps this is too cautious an approach then lets adjust. First of all can you provide an example of this injection so I can search for relevant priorart? |