Bug 1348507 - Arbitrary code execution due to insecure loading of Python module(s) from CWD
Summary: Arbitrary code execution due to insecure loading of Python module(s) from CWD
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: python-qt5
Version: 25
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Than Ngo
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1348410
TreeView+ depends on / blocked
 
Reported: 2016-06-21 10:52 UTC by Dhiru Kholia
Modified: 2017-08-04 20:50 UTC (History)
3 users (show)

Fixed In Version: python-qt5-5.8.1-4.fc26 python-qt5-5.7-7.fc25
Clone Of:
Environment:
Last Closed: 2017-07-31 06:25:21 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Dhiru Kholia 2016-06-21 10:52:44 UTC
The /usr/bin/pyuic5 script from the python-qt5-devel package tries to load the "PyQt5" Python module from the current working directory (CWD).

Steps to Reproduce:

$ cat > PyQt5.py
print("boom!")

$ pyuic5  # run /usr/bin/pyuic5
boom!
...

Additional info:

This bug is very similar to https://bugzilla.redhat.com/show_bug.cgi?id=995060

Comment 1 Than Ngo 2017-06-30 16:14:19 UTC
it's fixed in next build in rawhide

Comment 2 Miro Hrončok 2017-07-26 09:56:08 UTC
What exactly fixed it? I'm looking at the git log and %changelog and cannot find anything relevant. Thanks

Comment 3 Miro Hrončok 2017-07-26 10:03:15 UTC
Actually this has not been fixed:

<mock-chroot> sh-4.4# cat > PyQt5.py
print("boom!")

<mock-chroot> sh-4.4# pyuic5
boom!
...

<mock-chroot> sh-4.4# rpm -q python-qt5
python-qt5-5.9-2.fc27.x86_64

Comment 4 Than Ngo 2017-07-26 15:57:26 UTC
i just forgot to commit and build it into rawhide. The fix is included in the new python-qt5-5.9-3.fc27.

https://koji.fedoraproject.org/koji/taskinfo?taskID=20766225

Sorry and thanks for your attention.

Comment 5 Miro Hrončok 2017-07-26 16:12:11 UTC
I tried to edit the file accordingly:

<mock-chroot> sh-4.4# cat /usr/bin/pyuic5 
#!/bin/sh
/usr/bin/python3 -Ic "import PyQt5.uic.pyuic" &> /dev/null
if [ $? -eq 0 ]; then
  exec /usr/bin/python3 -Im PyQt5.uic.pyuic ${1+"$@"}
else
  exec /usr/bin/python2 -Esm PyQt5.uic.pyuic ${1+"$@"}
fi
<mock-chroot> sh-4.4# pyuic5 
boom!
/usr/bin/python2: No module named uic


Will actually try the package unce built to eliminate the fact that I've edited it wrong.

Comment 6 Miro Hrončok 2017-07-26 16:32:01 UTC
Indeed it is not fixed.

<mock-chroot> sh-4.4# cat > PyQt5.py
print("boom!")

<mock-chroot> sh-4.4# pyuic5
boom!
...

<mock-chroot> sh-4.4# rpm -q python-qt5
python-qt5-5.9-3.fc27.x86_64

Comment 7 Than Ngo 2017-07-27 08:37:19 UTC
It seems you are testing it with python2 which still doesn't work correctly as expected. With python3 it works fine for me.

I fixed this issue for python2 in new python-qt5-5.9-4.fc27. Thanks for your testing and feedbacks!

Comment 8 Fedora Update System 2017-07-27 12:43:13 UTC
python-qt5-5.7-7.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-a14d76a140

Comment 9 Fedora Update System 2017-07-27 12:43:21 UTC
python-qt5-5.8.1-4.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-0ee6ae8853

Comment 10 Fedora Update System 2017-07-27 23:24:07 UTC
python-qt5-5.7-7.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-a14d76a140

Comment 11 Fedora Update System 2017-07-28 01:53:28 UTC
python-qt5-5.8.1-4.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-0ee6ae8853

Comment 12 Fedora Update System 2017-07-31 06:25:21 UTC
python-qt5-5.8.1-4.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2017-08-04 20:50:21 UTC
python-qt5-5.7-7.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.