Bug 31520 - db2XXX scripts have unsecure parameter passing
db2XXX scripts have unsecure parameter passing
Product: Red Hat Raw Hide
Classification: Retired
Component: docbook-utils (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Tim Waugh
: Security
Depends On:
  Show dependency treegraph
Reported: 2001-03-12 12:04 EST by matti aarnio
Modified: 2008-05-01 11:38 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2001-03-12 12:08:43 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description matti aarnio 2001-03-12 12:04:06 EST
package: docbook-utils-0.6-11

The  db2pdf(*),  db2dvi, db2ps, and db2rtf are all of

#! /bin/sh
jw -f docbook -b rtf $*

while they should be:

#! /bin/sh
jw -f docbook -b rtf "$*"

in case any of the passed options have IFS characters in them...

(*) The db2pdf is at package  docbook-utils-pdf  which isn't listed at RH
component dataset.
Comment 1 Tim Waugh 2001-03-12 12:08:38 EST
(ITYM "$@".)  Thanks for spotting it.
Comment 2 Tim Waugh 2001-03-12 13:42:38 EST
Fixed in docbook-utils-0.6-12 in rawhide, although I don't think it's really a 
security issue.

Note You need to log in before you can comment on or make changes to this bug.