Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
[security] Tools/scripts/get-remote-certificate.py is vulnerable to shell code injection #97612
Labels
Comments
vstinner
added
type-bug
|
Example: |
vstinner
changed the title
|
I removed mention of CVE-2022-37460: it was withdrawn according to @gpshead. |
vstinner
pushed a commit
to vstinner/cpython
that referenced
this issue
Sep 28, 2022
Fix a shell code injection vulnerability in the Tools/scripts/get-remote-certificate.py script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead.
vstinner
pushed a commit
to vstinner/cpython
that referenced
this issue
Sep 28, 2022
Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead.
vstinner
pushed a commit
to vstinner/cpython
that referenced
this issue
Sep 28, 2022
Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead.
vstinner
pushed a commit
to vstinner/cpython
that referenced
this issue
Sep 28, 2022
Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead.
vstinner
added a commit
that referenced
this issue
Sep 28, 2022
Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]>
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Sep 28, 2022
…honGH-97613) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44) Co-authored-by: Victor Stinner <[email protected]>
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Sep 28, 2022
…honGH-97613) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44) Co-authored-by: Victor Stinner <[email protected]>
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Sep 28, 2022
…honGH-97613) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44) Co-authored-by: Victor Stinner <[email protected]>
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Sep 28, 2022
…honGH-97613) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44) Co-authored-by: Victor Stinner <[email protected]>
vstinner
added a commit
to vstinner/cpython
that referenced
this issue
Sep 28, 2022
…hon#97613) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44)
miss-islington
added a commit
that referenced
this issue
Sep 28, 2022
Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44) Co-authored-by: Victor Stinner <[email protected]>
miss-islington
added a commit
that referenced
this issue
Sep 28, 2022
Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44) Co-authored-by: Victor Stinner <[email protected]>
|
I created https://discuss.python.org/t/remove-outdated-tools-scripts-scripts/19571 discussion to propose removing outdated example scripts. |
ambv
pushed a commit
that referenced
this issue
Oct 4, 2022
…97613) (GH-97632) gh-97612: Fix shell injection in get-remote-certificate.py (GH-97613) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44) Co-authored-by: Victor Stinner <[email protected]>
ambv
pushed a commit
that referenced
this issue
Oct 4, 2022
…97613) (GH-97633) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44) Co-authored-by: Victor Stinner <[email protected]>
ambv
pushed a commit
that referenced
this issue
Oct 5, 2022
) (#97634) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <[email protected]> (cherry picked from commit 83a0f44)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
vstinner commentedSep 28, 2022
•
edited
The
Tools/scripts/get-remote-certificate.pyscript is vulnerable to shell code injection. This vulnerability was reported by Caleb Shortt (@calebshortt).@calebshortt proposed PR #96014 to fix it.
The text was updated successfully, but these errors were encountered: