Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mimic: rgw: asio: check the remote endpoint before processing requests #30977

Merged
merged 1 commit into from Oct 22, 2019

Conversation

@theanalyst
Copy link
Member

theanalyst commented Oct 17, 2019

backport tracker: https://tracker.ceph.com/issues/41570


backport of #29967
parent tracker: https://tracker.ceph.com/issues/40018

this backport was staged using ceph-backport.sh version 15.0.0.5775
find the latest version at https://github.com/ceph/ceph/blob/master/src/script/ceph-backport.sh

`socket.remote_endpoint()` can throw exceptions corresponding to errors in the
`getpeername` syscall, make sure these are handled.

Fixes: CVE-2019-10222, https://tracker.ceph.com/issues/40018
Signed-off-by: Abhishek Lekshmanan <abhishek@suse.com>
(cherry picked from commit caa6531)

 Conflicts:
	src/rgw/rgw_asio_frontend.cc
conflicts due to optional-yield-ctx changes in master
@theanalyst theanalyst added this to the mimic milestone Oct 17, 2019
@theanalyst theanalyst added the rgw label Oct 17, 2019
@theanalyst theanalyst requested review from cbodley, smithfarm and yuriw Oct 17, 2019
@yuriw

This comment has been minimized.

Copy link
Contributor

yuriw commented Oct 18, 2019

@yuriw
yuriw approved these changes Oct 18, 2019
@yuriw yuriw merged commit 6dbba75 into ceph:mimic Oct 22, 2019
4 checks passed
4 checks passed
Docs: build check OK - docs built
Details
Signed-off-by all commits in this PR are signed
Details
Unmodified Submodules submodules for project are unmodified
Details
make check make check succeeded
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants
You can’t perform that action at this time.