* CVE-2017-2295 * https://puppet.com/security/cve/cve-2017-2295 * https://github.com/puppetlabs/puppet/commit/06d8c51 Fixes BZ#1452654epel9
Dominic Cleal
8 years ago
parent
6d30d07d32
commit
a3757312cb
@ -0,0 +1,99 @@
|
||||
From 06d8c51367ca932b9da5d9b01958cfc0adf0f2ea Mon Sep 17 00:00:00 2001
|
||||
From: Josh Cooper <josh@puppet.com>
|
||||
Date: Fri, 28 Apr 2017 12:09:11 -0700
|
||||
Subject: [PATCH] (PUP-7483) Reject all fact formats except PSON
|
||||
|
||||
Previously, an authenticated user could cause the master to execute
|
||||
YAML.load on user-specified input, as well as MessagePack.unpack if the
|
||||
msgpack gem was installed.
|
||||
|
||||
Since 3.2.2, agents have always sent facts as PSON. There is no reason
|
||||
to support other formats, so reject all fact formats except PSON.
|
||||
---
|
||||
lib/puppet/indirector/catalog/compiler.rb | 6 +++--
|
||||
spec/unit/indirector/catalog/compiler_spec.rb | 36 ++++++++++++++++++++++++---
|
||||
2 files changed, 36 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/lib/puppet/indirector/catalog/compiler.rb b/lib/puppet/indirector/catalog/compiler.rb
|
||||
index e4e60ce..16c8353 100644
|
||||
--- a/lib/puppet/indirector/catalog/compiler.rb
|
||||
+++ b/lib/puppet/indirector/catalog/compiler.rb
|
||||
@@ -25,9 +25,11 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
|
||||
# in Network::HTTP::Handler will automagically deserialize the value.
|
||||
if text_facts.is_a?(Puppet::Node::Facts)
|
||||
facts = text_facts
|
||||
- else
|
||||
+ elsif format == 'pson'
|
||||
# We unescape here because the corresponding code in Puppet::Configurer::FactHandler escapes
|
||||
- facts = Puppet::Node::Facts.convert_from(format, CGI.unescape(text_facts))
|
||||
+ facts = Puppet::Node::Facts.convert_from('pson', CGI.unescape(text_facts))
|
||||
+ else
|
||||
+ raise ArgumentError, "Unsupported facts format"
|
||||
end
|
||||
|
||||
unless facts.name == request.key
|
||||
diff --git a/spec/unit/indirector/catalog/compiler_spec.rb b/spec/unit/indirector/catalog/compiler_spec.rb
|
||||
index b134c90..d31eaee 100644
|
||||
--- a/spec/unit/indirector/catalog/compiler_spec.rb
|
||||
+++ b/spec/unit/indirector/catalog/compiler_spec.rb
|
||||
@@ -255,10 +255,10 @@ describe Puppet::Resource::Catalog::Compiler do
|
||||
@facts = Puppet::Node::Facts.new('hostname', "fact" => "value", "architecture" => "i386")
|
||||
end
|
||||
|
||||
- def a_request_that_contains(facts)
|
||||
+ def a_request_that_contains(facts, format = :pson)
|
||||
request = Puppet::Indirector::Request.new(:catalog, :find, "hostname", nil)
|
||||
- request.options[:facts_format] = "pson"
|
||||
- request.options[:facts] = CGI.escape(facts.render(:pson))
|
||||
+ request.options[:facts_format] = format.to_s
|
||||
+ request.options[:facts] = CGI.escape(facts.render(format))
|
||||
request
|
||||
end
|
||||
|
||||
@@ -277,7 +277,7 @@ describe Puppet::Resource::Catalog::Compiler do
|
||||
expect(facts.timestamp).to eq(time)
|
||||
end
|
||||
|
||||
- it "should convert the facts into a fact instance and save it" do
|
||||
+ it "accepts PSON facts" do
|
||||
request = a_request_that_contains(@facts)
|
||||
|
||||
options = {
|
||||
@@ -289,6 +289,34 @@ describe Puppet::Resource::Catalog::Compiler do
|
||||
|
||||
@compiler.extract_facts_from_request(request)
|
||||
end
|
||||
+
|
||||
+ it "rejects YAML facts" do
|
||||
+ request = a_request_that_contains(@facts, :yaml)
|
||||
+
|
||||
+ options = {
|
||||
+ :environment => request.environment,
|
||||
+ :transaction_uuid => request.options[:transaction_uuid],
|
||||
+ }
|
||||
+
|
||||
+ expect {
|
||||
+ @compiler.extract_facts_from_request(request)
|
||||
+ }.to raise_error(ArgumentError, /Unsupported facts format/)
|
||||
+ end
|
||||
+
|
||||
+ it "rejects unknown fact formats" do
|
||||
+ request = a_request_that_contains(@facts)
|
||||
+ request.options[:facts_format] = 'unknown-format'
|
||||
+
|
||||
+ options = {
|
||||
+ :environment => request.environment,
|
||||
+ :transaction_uuid => request.options[:transaction_uuid],
|
||||
+ }
|
||||
+
|
||||
+ expect {
|
||||
+ @compiler.extract_facts_from_request(request)
|
||||
+ }.to raise_error(ArgumentError, /Unsupported facts format/)
|
||||
+ end
|
||||
+
|
||||
end
|
||||
|
||||
describe "when finding nodes" do
|
||||
--
|
||||
2.7.4
|
||||
|
||||
Loading…
Reference in new issue