|
 |
b39623 |
From 3654abee6ead9f11f8bb9ba8fc71efd6fa4dabbc Mon Sep 17 00:00:00 2001
|
|
|
b39623 |
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <fidencio@redhat.com>
|
|
|
b39623 |
Date: Wed, 3 Jul 2019 14:59:07 +0200
|
|
|
b39623 |
Subject: [PATCH] tools,install-script: Deprecate --config
|
|
|
b39623 |
{user,admin}-password
|
|
|
b39623 |
MIME-Version: 1.0
|
|
|
b39623 |
Content-Type: text/plain; charset=UTF-8
|
|
|
b39623 |
Content-Transfer-Encoding: 8bit
|
|
|
b39623 |
|
|
|
b39623 |
Let's deprecate user-password and admin-password options of --config and
|
|
|
b39623 |
also warn out whenever they're passed to osinfo-install-script.
|
|
|
b39623 |
|
|
|
b39623 |
CVE-2019-13313
|
|
|
b39623 |
Libosinfo: osinfo-install-script option leaks password via command line
|
|
|
b39623 |
argument. 'osinfo-install-script' is used to generate a script for
|
|
|
b39623 |
automated guest installations. It accepts user and admin passwords via
|
|
|
b39623 |
command line arguments, thus leaking them via process listing.
|
|
|
b39623 |
|
|
|
b39623 |
Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
|
|
|
b39623 |
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
|
b39623 |
---
|
|
|
b39623 |
tools/osinfo-install-script.c | 10 ++++++++++
|
|
|
b39623 |
1 file changed, 10 insertions(+)
|
|
|
b39623 |
|
|
|
b39623 |
diff --git a/tools/osinfo-install-script.c b/tools/osinfo-install-script.c
|
|
|
b39623 |
index af58440..c0528e7 100644
|
|
|
b39623 |
--- a/tools/osinfo-install-script.c
|
|
|
b39623 |
+++ b/tools/osinfo-install-script.c
|
|
|
b39623 |
@@ -85,6 +85,12 @@ static gboolean handle_config(const gchar *option_name G_GNUC_UNUSED,
|
|
|
b39623 |
val++;
|
|
|
b39623 |
key = g_strndup(value, len);
|
|
|
b39623 |
|
|
|
b39623 |
+ if (g_str_equal(key, OSINFO_INSTALL_CONFIG_PROP_USER_PASSWORD) ||
|
|
|
b39623 |
+ g_str_equal(key, OSINFO_INSTALL_CONFIG_PROP_ADMIN_PASSWORD)) {
|
|
|
b39623 |
+ g_warning("When setting user or admin password, use --config-file "
|
|
|
b39623 |
+ "instead.\n");
|
|
|
b39623 |
+ }
|
|
|
b39623 |
+
|
|
|
b39623 |
osinfo_entity_set_param(OSINFO_ENTITY(config),
|
|
|
b39623 |
key,
|
|
|
b39623 |
val);
|
|
|
b39623 |
@@ -556,10 +562,14 @@ The local language
|
|
|
b39623 |
=item C<admin-password>
|
|
|
b39623 |
|
|
|
b39623 |
The administrator password
|
|
|
b39623 |
+This option has been deprecated, use B<--config-file>
|
|
|
b39623 |
+for setting the admin password.
|
|
|
b39623 |
|
|
|
b39623 |
=item C<user-password>
|
|
|
b39623 |
|
|
|
b39623 |
The user password
|
|
|
b39623 |
+This option has been deprecated, use B<--config-file>
|
|
|
b39623 |
+for setting the user password.
|
|
|
b39623 |
|
|
|
b39623 |
=item C<user-login>
|
|
|
b39623 |
|
|
|
b39623 |
--
|
|
|
b39623 |
2.21.0
|
|
|
b39623 |
|