From 6a86650109b8654f5898369e45d3857624edf907 Mon Sep 17 00:00:00 2001 From: Abhijeet Kasurde Date: Tue, 10 Dec 2019 17:48:55 +0530 Subject: [2.7] solaris_zone: Allow only valid characters in zone name CVE-2019-14904 - solaris_zone module accepts zone name and performs actions related to that. However, there is no user input validation done while performing actions. A malicious user could provide a crafted zone name which allows executing commands into the server manipulating the module behaviour. Adding user input validation as per Solaris Zone documentation fixes this issue. Signed-off-by: Abhijeet Kasurde --- changelogs/fragments/solaris_zone_name_fix.yml | 5 +++++ lib/ansible/modules/system/solaris_zone.py | 11 +++++++++++ 2 files changed, 16 insertions(+) create mode 100644 changelogs/fragments/solaris_zone_name_fix.yml diff --git a/changelogs/fragments/solaris_zone_name_fix.yml b/changelogs/fragments/solaris_zone_name_fix.yml new file mode 100644 index 0000000000..eea9785f1a --- /dev/null +++ b/changelogs/fragments/solaris_zone_name_fix.yml @@ -0,0 +1,5 @@ +bugfixes: +- "**SECURITY** - CVE-2019-14904 - solaris_zone module accepts zone name and performs actions related to that. + However, there is no user input validation done while performing actions. A malicious user could provide a + crafted zone name which allows executing commands into the server manipulating the module behaviour. Adding + user input validation as per Solaris Zone documentation fixes this issue." diff --git a/lib/ansible/modules/system/solaris_zone.py b/lib/ansible/modules/system/solaris_zone.py index 87c94674f2..fbe16da7ec 100644 --- a/lib/ansible/modules/system/solaris_zone.py +++ b/lib/ansible/modules/system/solaris_zone.py @@ -41,6 +41,11 @@ options: name: description: - Zone name. + - A zone name must be unique name. + - A zone name must begin with an alpha-numeric character. + - The name can contain alpha-numeric characters, underbars I(_), hyphens I(-), and periods I(.). + - The name cannot be longer than 64 characters. + type: str required: true path: description: @@ -137,6 +142,7 @@ EXAMPLES = ''' import os import platform +import re import tempfile import time @@ -173,6 +179,11 @@ class Zone(object): if int(self.os_minor) < 10: self.module.fail_json(msg='This module requires Solaris 10 or later') + match = re.match('^[a-zA-Z0-9][-_.a-zA-Z0-9]{0,62}$', self.name) + if not match: + self.module.fail_json(msg="Provided zone name is not a valid zone name. " + "Please refer documentation for correct zone name specifications.") + def configure(self): if not self.path: self.module.fail_json(msg='Missing required argument: path') -- cgit v1.2.1