From 16b3a351cc4bc5d5e37c82514d7ef363ceb29aa8 Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 1/10] use QueryProcessor in get_archive_type --- diff --git a/hub/kojihub.py b/hub/kojihub.py index 46b8f3e..78352db 100644 --- a/hub/kojihub.py +++ b/hub/kojihub.py @@ -6222,13 +6222,15 @@ def get_archive_type(filename=None, type_name=None, type_id=None, strict=False): raise koji.GenericError('one of filename, type_name, or type_id must be specified') parts = filename.split('.') - + query = QueryProcessor( + tables=['archivetypes'], + columns=['id', 'name', 'description', 'extensions'], + clauses=['extensions ~* %(pattern)s'], + ) for start in range(len(parts)-1, -1, -1): ext = '.'.join(parts[start:]) - - select = r"""SELECT id, name, description, extensions FROM archivetypes - WHERE extensions ~* E'(\\s|^)%s(\\s|$)'""" % ext - results = _multiRow(select, locals(), ('id', 'name', 'description', 'extensions')) + query.values['pattern'] = r'(\s|^)%s(\s|$)' % ext + results = query.execute() if len(results) == 1: return results[0] From 4eb3f50d1be6050e46e30fef0ee70ffedd66a54f Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 2/10] fix arches handling in listHosts --- diff --git a/hub/kojihub.py b/hub/kojihub.py index 78352db..b4b4eb1 100644 --- a/hub/kojihub.py +++ b/hub/kojihub.py @@ -10889,8 +10889,8 @@ class RootExports(object): # matching 'ppc64' if not isinstance(arches, (list, tuple)): arches = [arches] - archClause = [r"""arches ~ E'\\m%s\\M'""" % arch for arch in arches] - clauses.append('(' + ' OR '.join(archClause) + ')') + archPattern = r'\m(%s)\M' % '|'.join(arches) + clauses.append('arches ~ %(archPattern)s') if channelID is not None: channelID = get_channel_id(channelID, strict=True) joins.append('host_channels ON host.id = host_channels.host_id') From c41a7a52a5d55290acd8bd7deb5295b66fd1ac61 Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 3/10] fix typeInfo handling in list_archives --- diff --git a/hub/kojihub.py b/hub/kojihub.py index b4b4eb1..b3f06b5 100644 --- a/hub/kojihub.py +++ b/hub/kojihub.py @@ -4207,8 +4207,10 @@ def list_archives(buildID=None, buildrootID=None, componentBuildrootID=None, hos val = typeInfo[key] if not isinstance(val, (list, tuple)): val = [val] - for v in val: - clauses.append(r"""%s ~ E'\\m%s\\M'""" % (key, v)) + for i, v in enumerate(val): + pkey = '%s_pattern_%i' % (key, i) + values[pkey] = r'\m%s\M' % v + clauses.append('%s ~ %%(%s)s' % (key, pkey)) elif type == 'image': joins.append('image_archives ON archiveinfo.id = image_archives.archive_id') fields.append(['image_archives.arch', 'arch']) From f6f2984e18ed2d9fa39be654b1b4340d7ed8678c Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 4/10] fix unit test for list_archives --- diff --git a/tests/test_hub/test_list_archives.py b/tests/test_hub/test_list_archives.py index 60694af..a70b549 100644 --- a/tests/test_hub/test_list_archives.py +++ b/tests/test_hub/test_list_archives.py @@ -177,10 +177,14 @@ class TestListArchives(DBQueryTestCase): 'win_archives ON archiveinfo.id = win_archives.archive_id']), clauses=sorted([ 'win_archives.relpath = %(relpath)s', - r"platforms ~ E'\\mall\\M'", - r"flags ~ E'\\mA\\M'", - r"flags ~ E'\\mB\\M'"]), - values={'relpath': 'somerelpath'}, + r"platforms ~ %(platforms_pattern_0)s", + r"flags ~ %(flags_pattern_0)s", + r"flags ~ %(flags_pattern_1)s"]), + values={'relpath': 'somerelpath', + 'flags_pattern_0': '\\mA\\M', + 'flags_pattern_1': '\\mB\\M', + 'platforms_pattern_0': '\\mall\\M', + }, colsByAlias={'relpath': 'win_archives.relpath', 'platforms': 'win_archives.platforms', 'flags': 'win_archives.flags', From 208c6433d751cca389f4a3085119ef1731e7c2cc Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 5/10] fix unit tests for listHosts --- diff --git a/tests/test_hub/test_list_hosts.py b/tests/test_hub/test_list_hosts.py index a2b8ecd..4c51da2 100644 --- a/tests/test_hub/test_list_hosts.py +++ b/tests/test_hub/test_list_hosts.py @@ -71,8 +71,8 @@ class TestListHosts(unittest.TestCase): query = self.queries[0] self.assertEqual(query.tables, ['host_config']) self.assertEqual(query.joins, ['host ON host.id = host_config.host_id']) - self.assertEqual(query.clauses, [r"""(arches ~ E'\\mx86_64\\M')""", - 'host_config.active IS TRUE']) + self.assertEqual(query.clauses, ['arches ~ %(archPattern)s', + 'host_config.active IS TRUE']) def test_list_hosts_multi_arch(self): self.exports.listHosts(arches=['x86_64', 's390']) @@ -82,7 +82,7 @@ class TestListHosts(unittest.TestCase): self.assertEqual(query.tables, ['host_config']) self.assertEqual(query.joins, ['host ON host.id = host_config.host_id']) self.assertEqual(query.clauses, [ - r"""(arches ~ E'\\mx86_64\\M' OR arches ~ E'\\ms390\\M')""", + 'arches ~ %(archPattern)s', 'host_config.active IS TRUE']) def test_list_hosts_bad_arch(self): From 5671aba4d4fceaba47e6bb38959102e356b07e95 Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 6/10] CVE-2018-1002161 announcement text --- diff --git a/docs/source/CVE-2018-1002161.rst b/docs/source/CVE-2018-1002161.rst new file mode 100644 index 0000000..33fb6c9 --- /dev/null +++ b/docs/source/CVE-2018-1002161.rst @@ -0,0 +1,66 @@ +================ +CVE-2018-1002161 +================ + +SQL injection in multiple remote calls + +.. toctree:: + :hidden: + + CVE-2018-1002161-FAQ + + +Summary +------- + +This is a critical security bug. + +Multiple xmlrpc call handlers in Koji’s hub code contain SQL injection bugs. By +passing carefully constructed arguments to these calls, an unauthenticated user +can issue arbitrary SQL commands to Koji’s database. This gives the attacker +broad ability to manipulate or destroy data. + +There is no known workaround. All Koji admins are encouraged to update to a +fixed version as soon as possible. + + + +Bug fix +------- + +Note: because code fixes can take time to deploy, we recommend +that all admins shut down their Koji hub instances until the fix +can be applied. + +We are releasing updates for several recent versions of Koji to fix this +bug. The following `releases `_ all +contain the fix: + +- 1.16.2 +- 1.15.2 +- 1.14.2 +- 1.13.2 +- 1.12.2 +- 1.11.1 + +Note: the legacy-py24 branch is unaffected since it +is client-only (no hub). + +For users who have customized their Koji code, we recommend rebasing +your work onto the appropriate update release. If this is not feasible, +the patch should be very easy to apply. Please see `issue +#1183 `_ for the code details. + +As with all changes to hub code, you must restart httpd for the changes +to take effect. + +Links +----- + +Fixed versions can be found at our releases page: + + https://pagure.io/koji/releases + +Questions and answers about this issue + + :doc:`CVE-2018-1002161-FAQ` From 158e668318fda69a2bd9aeca054777a020620544 Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 7/10] CVE-2018-1002161 FAQ --- diff --git a/docs/source/CVE-2018-1002161-FAQ.rst b/docs/source/CVE-2018-1002161-FAQ.rst new file mode 100644 index 0000000..bb7b83d --- /dev/null +++ b/docs/source/CVE-2018-1002161-FAQ.rst @@ -0,0 +1,66 @@ +======================== +FAQ for CVE-2018-1002161 +======================== + +Following are answers to some questions regarding CVE-2018-1002161 +for Koji. If you haven’t already, you should read the +:doc:`announcement `. + +If you have questions not covered here or in the announcement, please +ask them on the koji-devel mailing list. + + https://lists.fedorahosted.org/archives/list/koji-devel@lists.fedorahosted.org/ + +Q: Does this issue affect Koji clients or builders? + + The issue only affects the Koji hub. + +Q: Which versions of Koji are affected? + + All previous versions of Koji are affected, except for the legacy-py24 + branch because it contains no hub code. + +Q: Where are the fixed versions? + + | For Koji 1.11, 1.11.1 and higher include the fix + | For Koji 1.12, 1.12.2 and higher include the fix + | For Koji 1.13, 1.13.2 and higher include the fix + | For Koji 1.14, 1.14.2 and higher include the fix + | For Koji 1.15, 1.15.2 and higher include the fix + | For Koji 1.16.2 and higher include the fix + + You can find all of these versions on our releases page: + + https://pagure.io/koji/releases + +Q: What about older versions? + + We have only backported the fix to Koji versions released in the past few + years. If you are still using a very old version of Koji, we strongly + recommend that you shut it down and migrate to a newer version. + +Q: What can be done with this exploit? + + The attacker can directly manipulate the database as they see fit. This + would, among other things, allow them to gain the admin permission within + Koji. They could destroy or corrupt the database, add new builds, replace + existing builds, or any number of other things. + +Q: Can the attacker execute arbitrary code? + + On the hub, not that we know of. + + However, they could create arbitrary tasks, which would be run by the build + hosts. + +Q: Where can I get more help? + + You can ask questions on the koji-devel mailing list + (`koji-devel@fedorahosted.org `_). + + For real time communication, we have the #koji IRC channel on + `Freenode `_. + The best time to ask would be during the Koji devel team + “office hours”, which are held each Tuesday and Thursday from + 10-11am eastern time. + From 52cfc578b6bb5381ec816ccd9ff1b8d94e3efdba Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 8/10] update cve index --- diff --git a/docs/source/CVEs.rst b/docs/source/CVEs.rst index 8af389c..4b4d9aa 100644 --- a/docs/source/CVEs.rst +++ b/docs/source/CVEs.rst @@ -5,5 +5,6 @@ Koji CVEs .. toctree:: :titlesonly: + CVE-2018-1002161 CVE-2018-1002150 CVE-2017-1002153 From f6c911fb632386a752948199915f866cc0aaeb03 Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 9/10] 1.16.2 release notes --- diff --git a/docs/source/release_notes.rst b/docs/source/release_notes.rst index d98e8e9..4c087f5 100644 --- a/docs/source/release_notes.rst +++ b/docs/source/release_notes.rst @@ -5,6 +5,8 @@ Release Notes .. toctree:: :maxdepth: 1 + release_notes_1.16.2 + release_notes_1.16.1 release_notes_1.16 release_notes_1.15.1 release_notes_1.15 diff --git a/docs/source/release_notes_1.16.2.rst b/docs/source/release_notes_1.16.2.rst new file mode 100644 index 0000000..432b932 --- /dev/null +++ b/docs/source/release_notes_1.16.2.rst @@ -0,0 +1,18 @@ +Koji 1.16.2 Release Notes +========================= + +Koji 1.16.2 is a bugfix release for Koji 1.16. +The purpose of this release is address :doc:`CVE-2018-1002161`. + +See also: + +- :doc:`release_notes_1.16.1` + +- :doc:`release_notes_1.16` + + +Issues fixed in 1.16.2 +---------------------- + +- `Issue 1183 `_ -- + CVE-2018-1002161 From f88ebd494c1d85433c37f0b55da5ed2949099124 Mon Sep 17 00:00:00 2001 From: Mike McLean Date: Feb 21 2019 14:34:47 +0000 Subject: [PATCH 10/10] pull in 1.16.1 release notes for completeness --- diff --git a/docs/source/release_notes_1.16.1.rst b/docs/source/release_notes_1.16.1.rst new file mode 100644 index 0000000..eb2f5b3 --- /dev/null +++ b/docs/source/release_notes_1.16.1.rst @@ -0,0 +1,59 @@ +Koji 1.16.1 Release Notes +========================= + +Koji 1.16.1 is a point release for Koji 1.16. The major changes include: + +- Allow target info to be read for different type tasks in channel policy. +- Create symlinks for builds imported onto non-default volumes. +- Fix RPMdiff issues found in Koji 1.16.0. + +Please see: :doc:`release_notes_1.16` + +Issues fixed in 1.16.1 +---------------------- + +- `Issue 847 `_ -- + spin-livecd failed with "Could not resolve host" + +- `Issue 932 `_ -- + Fix use_host_resolv with new mock version + +- `Issue 1010 `_ -- + koji fails runroot because of `UnicodeDecodeError` + +- `Issue 998 `_ -- + cancel build doesn't work for images + +- `Issue 994 `_ -- + rpmdiff calculate wrong results + +- `Issue 1025 `_ -- + missing default volume symlink for imported builds affected by volume policy + +- `Issue 1007 `_ -- + decode_args() might result in --package parameter missing in runroot command + +- `Issue 150 `_ -- + no target info in channel policy for non-rpm tasks + +- `PR: 973 `_ -- + Check empty arches before spawning dist-repo + +- `Issue 958 `_ -- + Notification for tagBuildBypass is writing message untagged from, expected message tagged into + +- `Issue 968 `_ -- + Default enable python3 on RHEL8 + +- `Issue 916 `_ -- + `clone-tag` doesn't preserve tagging order + +- `Issue 949 `_ -- + cli: [rpminfo] KeyError: 'license' for external RPM + +- `Issue 876 `_ -- + koji clone-tag raises "UnboundLocalError" + +- `Issue 945 `_ -- + Koji build fail due to ambiguous python shebang +