[Starlingx-discuss] May have to consider an lshell replacement
Folks, As I was looking at the upstream patches, I looked into the status of lshell and noticed there was an existing open issue[0] which referenced 2 CVEs: - CVE-2016-6902 - remote authenticated users can break out of a limited shell and execute arbitrary commands. - CVE-2016-6903 - lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands. These are related, and there is a potential fix, but issue 150 [3] seems to indicate the patch is not complete. The maintainer has expressed that he not able to do anything about this as of May this year. Additionally lshell is python2 based and would need to be converted to python3. I went so far as proposing a very simple change to their README.md to fix a bad link and it stalled in their travis tox check. Sau! [0] https://github.com/ghantoos/lshell/issues/188 [1] https://nvd.nist.gov/vuln/detail/CVE-2016-6902 [2] https://nvd.nist.gov/vuln/detail/CVE-2016-6903 [0] https://github.com/ghantoos/lshell/issues/150
What alternatives do we have for this functionality? brucej -----Original Message----- From: Saul Wold [mailto:sgw@linux.intel.com] Sent: Thursday, September 27, 2018 10:42 AM To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] May have to consider an lshell replacement Folks, As I was looking at the upstream patches, I looked into the status of lshell and noticed there was an existing open issue[0] which referenced 2 CVEs: - CVE-2016-6902 - remote authenticated users can break out of a limited shell and execute arbitrary commands. - CVE-2016-6903 - lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands. These are related, and there is a potential fix, but issue 150 [3] seems to indicate the patch is not complete. The maintainer has expressed that he not able to do anything about this as of May this year. Additionally lshell is python2 based and would need to be converted to python3. I went so far as proposing a very simple change to their README.md to fix a bad link and it stalled in their travis tox check. Sau! [0] https://github.com/ghantoos/lshell/issues/188 [1] https://nvd.nist.gov/vuln/detail/CVE-2016-6902 [2] https://nvd.nist.gov/vuln/detail/CVE-2016-6903 [0] https://github.com/ghantoos/lshell/issues/150 _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E <bruce.e.jones@intel.com> wrote:
What alternatives do we have for this functionality?
Alternatives in increasing levels of commitment to lshell: * replace it * fork the project and fix the CVEs and continue * adopt the project and take over maintenance as a stand0-alone project should the existing maintainer be interested in doing so[0] I am specifically not listing 'do nothing' as active CVEs must be addressed... dt [0] OpenStack has done this on occasion when a dependency goes dormant and the maintainer has no interest in continuing and the cost of converting outweighs the perceived cost of maintenance and ownership. -- Dean Troyer dtroyer@gmail.com
Dean / Saul, We agree that the all security issues are initially embargoed. Therefore, this topic should not be discussed on the mailing list until it has been vetted by the security team. The security team has published a method to raise these issues. You will find it here: https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... I would suggest that we open a Security launchpad and we can continue the discussion there. Thank you in advance. Regards, Ken Y On 2018-09-27, 3:07 PM, "Dean Troyer" <dtroyer@gmail.com> wrote: On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E <bruce.e.jones@intel.com> wrote: > What alternatives do we have for this functionality? Alternatives in increasing levels of commitment to lshell: * replace it * fork the project and fix the CVEs and continue * adopt the project and take over maintenance as a stand0-alone project should the existing maintainer be interested in doing so[0] I am specifically not listing 'do nothing' as active CVEs must be addressed... dt [0] OpenStack has done this on occasion when a dependency goes dormant and the maintainer has no interest in continuing and the cost of converting outweighs the perceived cost of maintenance and ownership. -- Dean Troyer dtroyer@gmail.com _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Bug https://bugs.launchpad.net/starlingx/+bug/1794868 filed. Saul and Dean added to it. brucej -----Original Message----- From: Young, Ken [mailto:Ken.Young@windriver.com] Sent: Thursday, September 27, 2018 12:28 PM To: Dean Troyer <dtroyer@gmail.com>; Saul Wold <sgw@linux.intel.com> Cc: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] FW: May have to consider an lshell replacement Dean / Saul, We agree that the all security issues are initially embargoed. Therefore, this topic should not be discussed on the mailing list until it has been vetted by the security team. The security team has published a method to raise these issues. You will find it here: https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... I would suggest that we open a Security launchpad and we can continue the discussion there. Thank you in advance. Regards, Ken Y On 2018-09-27, 3:07 PM, "Dean Troyer" <dtroyer@gmail.com> wrote: On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E <bruce.e.jones@intel.com> wrote: > What alternatives do we have for this functionality? Alternatives in increasing levels of commitment to lshell: * replace it * fork the project and fix the CVEs and continue * adopt the project and take over maintenance as a stand0-alone project should the existing maintainer be interested in doing so[0] I am specifically not listing 'do nothing' as active CVEs must be addressed... dt [0] OpenStack has done this on occasion when a dependency goes dormant and the maintainer has no interest in continuing and the cost of converting outweighs the perceived cost of maintenance and ownership. -- Dean Troyer dtroyer@gmail.com _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Bruce, Can you add the VMT team to the bug please? I cannot open this. Thanks! /KenY On 2018-09-27, 3:42 PM, "Jones, Bruce E" <bruce.e.jones@intel.com> wrote: Bug https://bugs.launchpad.net/starlingx/+bug/1794868 filed. Saul and Dean added to it. brucej -----Original Message----- From: Young, Ken [mailto:Ken.Young@windriver.com] Sent: Thursday, September 27, 2018 12:28 PM To: Dean Troyer <dtroyer@gmail.com>; Saul Wold <sgw@linux.intel.com> Cc: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] FW: May have to consider an lshell replacement Dean / Saul, We agree that the all security issues are initially embargoed. Therefore, this topic should not be discussed on the mailing list until it has been vetted by the security team. The security team has published a method to raise these issues. You will find it here: https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... I would suggest that we open a Security launchpad and we can continue the discussion there. Thank you in advance. Regards, Ken Y On 2018-09-27, 3:07 PM, "Dean Troyer" <dtroyer@gmail.com> wrote: On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E <bruce.e.jones@intel.com> wrote: > What alternatives do we have for this functionality? Alternatives in increasing levels of commitment to lshell: * replace it * fork the project and fix the CVEs and continue * adopt the project and take over maintenance as a stand0-alone project should the existing maintainer be interested in doing so[0] I am specifically not listing 'do nothing' as active CVEs must be addressed... dt [0] OpenStack has done this on occasion when a dependency goes dormant and the maintainer has no interest in continuing and the cost of converting outweighs the perceived cost of maintenance and ownership. -- Dean Troyer dtroyer@gmail.com _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
My bad, fixed now. brucej -----Original Message----- From: Young, Ken [mailto:Ken.Young@windriver.com] Sent: Thursday, September 27, 2018 1:38 PM To: Jones, Bruce E <bruce.e.jones@intel.com>; Dean Troyer <dtroyer@gmail.com>; Saul Wold <sgw@linux.intel.com> Cc: starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] FW: May have to consider an lshell replacement Bruce, Can you add the VMT team to the bug please? I cannot open this. Thanks! /KenY On 2018-09-27, 3:42 PM, "Jones, Bruce E" <bruce.e.jones@intel.com> wrote: Bug https://bugs.launchpad.net/starlingx/+bug/1794868 filed. Saul and Dean added to it. brucej -----Original Message----- From: Young, Ken [mailto:Ken.Young@windriver.com] Sent: Thursday, September 27, 2018 12:28 PM To: Dean Troyer <dtroyer@gmail.com>; Saul Wold <sgw@linux.intel.com> Cc: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] FW: May have to consider an lshell replacement Dean / Saul, We agree that the all security issues are initially embargoed. Therefore, this topic should not be discussed on the mailing list until it has been vetted by the security team. The security team has published a method to raise these issues. You will find it here: https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... I would suggest that we open a Security launchpad and we can continue the discussion there. Thank you in advance. Regards, Ken Y On 2018-09-27, 3:07 PM, "Dean Troyer" <dtroyer@gmail.com> wrote: On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E <bruce.e.jones@intel.com> wrote: > What alternatives do we have for this functionality? Alternatives in increasing levels of commitment to lshell: * replace it * fork the project and fix the CVEs and continue * adopt the project and take over maintenance as a stand0-alone project should the existing maintainer be interested in doing so[0] I am specifically not listing 'do nothing' as active CVEs must be addressed... dt [0] OpenStack has done this on occasion when a dependency goes dormant and the maintainer has no interest in continuing and the cost of converting outweighs the perceived cost of maintenance and ownership. -- Dean Troyer dtroyer@gmail.com _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Is LShell and ibsh specific to CentOS or it applicable for other OS? Say for example, can we look for alternatives that Ubuntu or ClearLinux is using for the similar functionality? Thanks. - cindy -----Original Message----- From: Dean Troyer [mailto:dtroyer@gmail.com] Sent: Friday, September 28, 2018 3:07 AM To: Jones, Bruce E <bruce.e.jones@intel.com> Cc: starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] May have to consider an lshell replacement On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E <bruce.e.jones@intel.com> wrote:
What alternatives do we have for this functionality?
Alternatives in increasing levels of commitment to lshell: * replace it * fork the project and fix the CVEs and continue * adopt the project and take over maintenance as a stand0-alone project should the existing maintainer be interested in doing so[0] I am specifically not listing 'do nothing' as active CVEs must be addressed... dt [0] OpenStack has done this on occasion when a dependency goes dormant and the maintainer has no interest in continuing and the cost of converting outweighs the perceived cost of maintenance and ownership. -- Dean Troyer dtroyer@gmail.com _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Cindy, I will copy these questions to the launchpad. Team,. Please keep all discussion of this issue within the launchpad. Regards, Ken Y On 2018-09-27, 9:02 PM, "Xie, Cindy" <cindy.xie@intel.com> wrote: Is LShell and ibsh specific to CentOS or it applicable for other OS? Say for example, can we look for alternatives that Ubuntu or ClearLinux is using for the similar functionality? Thanks. - cindy -----Original Message----- From: Dean Troyer [mailto:dtroyer@gmail.com] Sent: Friday, September 28, 2018 3:07 AM To: Jones, Bruce E <bruce.e.jones@intel.com> Cc: starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] May have to consider an lshell replacement On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E <bruce.e.jones@intel.com> wrote: > What alternatives do we have for this functionality? Alternatives in increasing levels of commitment to lshell: * replace it * fork the project and fix the CVEs and continue * adopt the project and take over maintenance as a stand0-alone project should the existing maintainer be interested in doing so[0] I am specifically not listing 'do nothing' as active CVEs must be addressed... dt [0] OpenStack has done this on occasion when a dependency goes dormant and the maintainer has no interest in continuing and the cost of converting outweighs the perceived cost of maintenance and ownership. -- Dean Troyer dtroyer@gmail.com _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Same thing can apply for ibsh, seems to be dead since 2005. http://ibsh.sourceforge.net/ -Erich On Thu, 2018-09-27 at 10:41 -0700, Saul Wold wrote:
Folks,
As I was looking at the upstream patches, I looked into the status of lshell and noticed there was an existing open issue[0] which referenced 2 CVEs:
- CVE-2016-6902 - remote authenticated users can break out of a limited shell and execute arbitrary commands. - CVE-2016-6903 - lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
These are related, and there is a potential fix, but issue 150 [3] seems to indicate the patch is not complete. The maintainer has expressed that he not able to do anything about this as of May this year. Additionally lshell is python2 based and would need to be converted to python3.
I went so far as proposing a very simple change to their README.md to fix a bad link and it stalled in their travis tox check.
Sau!
[0] https://github.com/ghantoos/lshell/issues/188 [1] https://nvd.nist.gov/vuln/detail/CVE-2016-6902 [2] https://nvd.nist.gov/vuln/detail/CVE-2016-6903 [0] https://github.com/ghantoos/lshell/issues/150
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
participants (6)
-
Cordoba Malibran, Erich
-
Dean Troyer
-
Jones, Bruce E
-
Saul Wold
-
Xie, Cindy
-
Young, Ken