[Starlingx-discuss] May have to consider an lshell replacement

[Saul Wold]

Folks,

As I was looking at the upstream patches, I looked into the status of 
lshell and noticed there was an existing open issue[0] which referenced 
2 CVEs:

  - CVE-2016-6902 - remote authenticated users can break out of a 
limited shell and execute arbitrary commands.
  - CVE-2016-6903 - lshell 0.9.16 allows remote authenticated users to 
break out of a limited shell and execute arbitrary commands.

These are related, and there is a potential fix, but issue 150 [3] seems 
to indicate the patch is not complete. The maintainer has expressed that 
he not able to do anything about this as of May this year. Additionally 
lshell is python2 based and would need to be converted to python3.

I went so far as proposing a very simple change to their README.md to 
fix a bad link and it stalled in their travis tox check.

Sau!

[0] https://github.com/ghantoos/lshell/issues/188
[1] https://nvd.nist.gov/vuln/detail/CVE-2016-6902
[2] https://nvd.nist.gov/vuln/detail/CVE-2016-6903
[0] https://github.com/ghantoos/lshell/issues/150