[Starlingx-discuss] May have to consider an lshell replacement

Saul Wold sgw at linux.intel.com
Thu Sep 27 17:41:35 UTC 2018


Folks,

As I was looking at the upstream patches, I looked into the status of 
lshell and noticed there was an existing open issue[0] which referenced 
2 CVEs:

  - CVE-2016-6902 - remote authenticated users can break out of a 
limited shell and execute arbitrary commands.
  - CVE-2016-6903 - lshell 0.9.16 allows remote authenticated users to 
break out of a limited shell and execute arbitrary commands.

These are related, and there is a potential fix, but issue 150 [3] seems 
to indicate the patch is not complete. The maintainer has expressed that 
he not able to do anything about this as of May this year. Additionally 
lshell is python2 based and would need to be converted to python3.

I went so far as proposing a very simple change to their README.md to 
fix a bad link and it stalled in their travis tox check.

Sau!

[0] https://github.com/ghantoos/lshell/issues/188
[1] https://nvd.nist.gov/vuln/detail/CVE-2016-6902
[2] https://nvd.nist.gov/vuln/detail/CVE-2016-6903
[0] https://github.com/ghantoos/lshell/issues/150



More information about the Starlingx-discuss mailing list