Open Stack

** Changed in: trove
     Assignee: Amrith Kumar (amrith) => (unassigned)

-- 
You received this bug notification because you are a member of OpenStack
Security, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1343657

Title:
  Shell Injection in backup strategies

Status in OpenStack Security Advisory:
  Won't Fix
Status in OpenStack Security Notes:
  Fix Released
Status in OpenStack DBaaS (Trove):
  Triaged

Bug description:
  Trove uses subprocess.Popen with shell=True in
  trove/trove/guestagent/strategies/backup/base.py line 61:

      def run(self):
          self.process = subprocess.Popen(self.command, shell=True,
                                          stdout=subprocess.PIPE,
                                          stderr=subprocess.PIPE,
                                          preexec_fn=os.setsid)
          self.pid = self.process.pid

  This could be used, maliciously or not, to inject arbitrary commands
  into a command line string. An example of this could be triggered is
  in trove/trove/guestagent/strategies/backup/mysql_imply.py line 37. It
  is creating a MySQL string with single quote. If the password, either
  maliciously or just happens to contain another single quote, it will
  escape from the command and arbitrary data will be executed instead.

  For more information on subprocess, shell=True and command injection
  see: https://docs.python.org/2/library/subprocess.html#frequently-
  used-arguments

To manage notifications about this bug go to:
https://bugs.launchpad.net/ossa/+bug/1343657/+subscriptions