|
 |
3ca9b2 |
From b6229fa5cff3cb7a503a3a9956a3ac71f2ecda52 Mon Sep 17 00:00:00 2001
|
|
|
3ca9b2 |
From: Matthew Heon <mheon@redhat.com>
|
|
|
3ca9b2 |
Date: Tue, 8 Sep 2020 09:30:26 -0400
|
|
|
3ca9b2 |
Subject: [PATCH] Fix CVE-2020-14370
|
|
|
3ca9b2 |
|
|
|
3ca9b2 |
Convert defaultEnvVariables to a function to ensure that we do
|
|
|
3ca9b2 |
not have a variable that can leak between container creation
|
|
|
3ca9b2 |
calls. This resolve CVE-2020-14370 for the 1.6 branch of Podman.
|
|
|
3ca9b2 |
|
|
|
3ca9b2 |
Signed-off-by: Matthew Heon <mheon@redhat.com>
|
|
|
3ca9b2 |
---
|
|
|
3ca9b2 |
cmd/podman/shared/create.go | 10 ++++++----
|
|
|
3ca9b2 |
1 file changed, 6 insertions(+), 4 deletions(-)
|
|
|
3ca9b2 |
|
|
|
3ca9b2 |
diff --git a/cmd/podman/shared/create.go b/cmd/podman/shared/create.go
|
|
|
3ca9b2 |
index dda36826e..b9f346691 100644
|
|
|
3ca9b2 |
--- a/cmd/podman/shared/create.go
|
|
|
3ca9b2 |
+++ b/cmd/podman/shared/create.go
|
|
|
3ca9b2 |
@@ -822,15 +822,17 @@ func CreateContainerFromCreateConfig(r *libpod.Runtime, createConfig *cc.CreateC
|
|
|
3ca9b2 |
return ctr, nil
|
|
|
3ca9b2 |
}
|
|
|
3ca9b2 |
|
|
|
3ca9b2 |
-var defaultEnvVariables = map[string]string{
|
|
|
3ca9b2 |
- "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
|
3ca9b2 |
- "TERM": "xterm",
|
|
|
3ca9b2 |
+func defaultEnvVariables() map[string]string {
|
|
|
3ca9b2 |
+ return map[string]string{
|
|
|
3ca9b2 |
+ "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
|
3ca9b2 |
+ "TERM": "xterm",
|
|
|
3ca9b2 |
+ }
|
|
|
3ca9b2 |
}
|
|
|
3ca9b2 |
|
|
|
3ca9b2 |
// EnvVariablesFromData gets sets the default environment variables
|
|
|
3ca9b2 |
// for containers, and reads the variables from the image data, if present.
|
|
|
3ca9b2 |
func EnvVariablesFromData(data *inspect.ImageData) map[string]string {
|
|
|
3ca9b2 |
- env := defaultEnvVariables
|
|
|
3ca9b2 |
+ env := defaultEnvVariables()
|
|
|
3ca9b2 |
if data != nil {
|
|
|
3ca9b2 |
for _, e := range data.Config.Env {
|
|
|
3ca9b2 |
split := strings.SplitN(e, "=", 2)
|
|
|
3ca9b2 |
--
|
|
|
3ca9b2 |
2.26.2
|
|
|
3ca9b2 |
|