Skip to content

Conversation

@vstinner
Copy link
Member

@vstinner vstinner commented Sep 28, 2022

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt [email protected]
(cherry picked from commit 83a0f44)

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt <[email protected]>
(cherry picked from commit 83a0f44)
@vstinner
Copy link
Member Author

Unrelated to this PR: test_int fails randomly on Windows x64:

FAIL: test_denial_of_service_prevented_str_to_int (test.test_int.IntSubclassStrDigitLimitsTests)
Regression test: ensure we fail before performing O(N**2) work.
----------------------------------------------------------------------
Traceback (most recent call last):
  File "D:\a\cpython\cpython\lib\test\test_int.py", line 654, in test_denial_of_service_prevented_str_to_int
    self.assertLess(seconds_to_fail_extra_huge, seconds_to_convert/8)
AssertionError: 0.015625 not less than 0.013671875

I re-run the job.

@ambv ambv merged commit c7ec780 into python:3.7 Oct 5, 2022
@vstinner vstinner deleted the get_certs37 branch December 13, 2022 15:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type-security A security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants