[Starlingx-discuss] May have to consider an lshell replacement
Cordoba Malibran, Erich
erich.cordoba.malibran at intel.com
Thu Sep 27 17:48:21 UTC 2018
Same thing can apply for ibsh, seems to be dead since 2005.
On Thu, 2018-09-27 at 10:41 -0700, Saul Wold wrote:
> As I was looking at the upstream patches, I looked into the status
> lshell and noticed there was an existing open issue which
> 2 CVEs:
> - CVE-2016-6902 - remote authenticated users can break out of a
> limited shell and execute arbitrary commands.
> - CVE-2016-6903 - lshell 0.9.16 allows remote authenticated users
> break out of a limited shell and execute arbitrary commands.
> These are related, and there is a potential fix, but issue 150 
> to indicate the patch is not complete. The maintainer has expressed
> he not able to do anything about this as of May this year.
> lshell is python2 based and would need to be converted to python3.
> I went so far as proposing a very simple change to their README.md
> fix a bad link and it stalled in their travis tox check.
>  https://github.com/ghantoos/lshell/issues/188
>  https://nvd.nist.gov/vuln/detail/CVE-2016-6902
>  https://nvd.nist.gov/vuln/detail/CVE-2016-6903
>  https://github.com/ghantoos/lshell/issues/150
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
More information about the Starlingx-discuss