[Starlingx-discuss] May have to consider an lshell replacement

Thu Sep 27 17:48:21 UTC 2018

Same thing can apply for ibsh, seems to be dead since 2005. 

http://ibsh.sourceforge.net/

-Erich

On Thu, 2018-09-27 at 10:41 -0700, Saul Wold wrote:
> Folks,
> 
> As I was looking at the upstream patches, I looked into the status
> of 
> lshell and noticed there was an existing open issue[0] which
> referenced 
> 2 CVEs:
> 
>   - CVE-2016-6902 - remote authenticated users can break out of a 
> limited shell and execute arbitrary commands.
>   - CVE-2016-6903 - lshell 0.9.16 allows remote authenticated users
> to 
> break out of a limited shell and execute arbitrary commands.
> 
> These are related, and there is a potential fix, but issue 150 [3]
> seems 
> to indicate the patch is not complete. The maintainer has expressed
> that 
> he not able to do anything about this as of May this year.
> Additionally 
> lshell is python2 based and would need to be converted to python3.
> 
> I went so far as proposing a very simple change to their README.md
> to 
> fix a bad link and it stalled in their travis tox check.
> 
> Sau!
> 
> [0] https://github.com/ghantoos/lshell/issues/188
> [1] https://nvd.nist.gov/vuln/detail/CVE-2016-6902
> [2] https://nvd.nist.gov/vuln/detail/CVE-2016-6903
> [0] https://github.com/ghantoos/lshell/issues/150
> 
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss