[Starlingx-discuss] May have to consider an lshell replacement

[Jones, Bruce E]

What alternatives do we have for this functionality?

       brucej

-----Original Message-----
From: Saul Wold [mailto:sgw at linux.intel.com] 
Sent: Thursday, September 27, 2018 10:42 AM
To: starlingx-discuss at lists.starlingx.io
Subject: [Starlingx-discuss] May have to consider an lshell replacement


Folks,

As I was looking at the upstream patches, I looked into the status of lshell and noticed there was an existing open issue[0] which referenced
2 CVEs:

  - CVE-2016-6902 - remote authenticated users can break out of a limited shell and execute arbitrary commands.
  - CVE-2016-6903 - lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

These are related, and there is a potential fix, but issue 150 [3] seems to indicate the patch is not complete. The maintainer has expressed that he not able to do anything about this as of May this year. Additionally lshell is python2 based and would need to be converted to python3.

I went so far as proposing a very simple change to their README.md to fix a bad link and it stalled in their travis tox check.

Sau!

[0] https://github.com/ghantoos/lshell/issues/188
[1] https://nvd.nist.gov/vuln/detail/CVE-2016-6902
[2] https://nvd.nist.gov/vuln/detail/CVE-2016-6903
[0] https://github.com/ghantoos/lshell/issues/150

_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss at lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss