Same thing can apply for ibsh, seems to be dead since 2005. http://ibsh.sourceforge.net/ -Erich On Thu, 2018-09-27 at 10:41 -0700, Saul Wold wrote:
Folks,
As I was looking at the upstream patches, I looked into the status of lshell and noticed there was an existing open issue[0] which referenced 2 CVEs:
- CVE-2016-6902 - remote authenticated users can break out of a limited shell and execute arbitrary commands. - CVE-2016-6903 - lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
These are related, and there is a potential fix, but issue 150 [3] seems to indicate the patch is not complete. The maintainer has expressed that he not able to do anything about this as of May this year. Additionally lshell is python2 based and would need to be converted to python3.
I went so far as proposing a very simple change to their README.md to fix a bad link and it stalled in their travis tox check.
Sau!
[0] https://github.com/ghantoos/lshell/issues/188 [1] https://nvd.nist.gov/vuln/detail/CVE-2016-6902 [2] https://nvd.nist.gov/vuln/detail/CVE-2016-6903 [0] https://github.com/ghantoos/lshell/issues/150
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss