Bug 705901

Summary:	monotone: crash of remote server when remote stdio enabled and empty prefix used
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	thomas.moschny
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-06-09 13:22:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	705902
Bug Blocks:

Description Vincent Danen 2011-05-18 20:13:27 UTC

Monotone 0.48.1 fixed [1],[2] a problem where a user could issue a command to a remote monotone server (running "mtn ''" or "mtn ls ''") and, if the remote server were configured to permit remote stdio commands (not the default), would cause the remote server to crash.

Only EPEL5 currently provides a vulnerable version of monotone.

[1] http://www.monotone.ca/NEWS
[2] https://code.monotone.ca/p/monotone/source/commit/2cc01e1baf1032ccf40053bd9910b12d7b87cce6/

Comment 1 Vincent Danen 2011-05-18 20:14:16 UTC

Created monotone tracking bugs for this issue

Affects: epel-5 [bug 705902]

Comment 2 Thomas Moschny 2011-06-09 13:22:33 UTC

So, I think this bug can be closed.