From a1b0f72c98b4b2afaab8aafa255e82c2075049c8 Mon Sep 17 00:00:00 2001 From: Abhijeet Kasurde Date: Tue, 10 Dec 2019 17:48:55 +0530 Subject: [PATCH] [2.9] solaris_zone: Allow only valid characters in zone name CVE-2019-14904 - solaris_zone module accepts zone name and performs actions related to that. However, there is no user input validation done while performing actions. A malicious user could provide a crafted zone name which allows executing commands into the server manipulating the module behaviour. Adding user input validation as per Solaris Zone documentation fixes this issue. Signed-off-by: Abhijeet Kasurde (cherry picked from commit 7d2ae7e3226cdc8e37aea83c202aeb0e7e5a1aec) --- changelogs/fragments/solaris_zone_name_fix.yml | 5 +++++ lib/ansible/modules/system/solaris_zone.py | 10 ++++++++++ 2 files changed, 15 insertions(+) create mode 100644 changelogs/fragments/solaris_zone_name_fix.yml diff --git a/changelogs/fragments/solaris_zone_name_fix.yml b/changelogs/fragments/solaris_zone_name_fix.yml new file mode 100644 index 00000000000..eea9785f1ad --- /dev/null +++ b/changelogs/fragments/solaris_zone_name_fix.yml @@ -0,0 +1,5 @@ +bugfixes: +- "**SECURITY** - CVE-2019-14904 - solaris_zone module accepts zone name and performs actions related to that. + However, there is no user input validation done while performing actions. A malicious user could provide a + crafted zone name which allows executing commands into the server manipulating the module behaviour. Adding + user input validation as per Solaris Zone documentation fixes this issue." diff --git a/lib/ansible/modules/system/solaris_zone.py b/lib/ansible/modules/system/solaris_zone.py index da6fcc659ea..6e4e943722b 100644 --- a/lib/ansible/modules/system/solaris_zone.py +++ b/lib/ansible/modules/system/solaris_zone.py @@ -43,6 +43,10 @@ options: name: description: - Zone name. + - A zone name must be unique name. + - A zone name must begin with an alpha-numeric character. + - The name can contain alpha-numeric characters, underbars I(_), hyphens I(-), and periods I(.). + - The name cannot be longer than 64 characters. type: str required: true path: @@ -147,6 +151,7 @@ EXAMPLES = ''' import os import platform +import re import tempfile import time @@ -183,6 +188,11 @@ class Zone(object): if int(self.os_minor) < 10: self.module.fail_json(msg='This module requires Solaris 10 or later') + match = re.match('^[a-zA-Z0-9][-_.a-zA-Z0-9]{0,62}$', self.name) + if not match: + self.module.fail_json(msg="Provided zone name is not a valid zone name. " + "Please refer documentation for correct zone name specifications.") + def configure(self): if not self.path: self.module.fail_json(msg='Missing required argument: path')