CVE-2018-1002101: smb mount security issue #65750
Assignees
Labels
area/security
kind/bug
Categorizes issue or PR as related to a bug.
official-cve-feed
Issues or PRs related to CVEs officially announced by Security Response Committee (SRC)
sig/storage
Categorizes an issue or PR as relevant to SIG Storage.
sig/windows
Categorizes an issue or PR as relevant to SIG Windows.
Comments
k8s-ci-robot
added
kind/bug
Merged
k8s-github-robot
pushed a commit
that referenced
this issue
Jul 3, 2018
Automatic merge from submit-queue (batch tested with PRs 65381, 65751). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. fix smb mount security issue **What this PR does / why we need it**: fix smb mount security issue: user PowerShell Environment Variables to store user input string to prevent command line injection, the env var in PowerShell would be taken as literal values and not as executable vulnerable code, this kind of fix is common for command line injection issue (called: parameterized way) Originally use go sdk for `New-SmbGlobalMapping` is best solution, while after discussion with Windows team, go API for `New-SmbGlobalMapping` is not ready yet and the new functionality of basic win32 API [NetUseAdd](https://msdn.microsoft.com/en-us/library/windows/desktop/aa370645(v=vs.85).aspx) is not public yet, use [PowerShell with Environment Variables](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_environment_variables?view=powershell-5.1) is also their recommended way. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes #65750 **Special notes for your reviewer**: - This is a security issue fix, no behavior change, E2E test of smb mount passes. - Original logging as `azureMount` is incorrect since this mount_windows is for mount disk & smb, it's a common feature on Windows, not specific to Azure, I will send another PR to fixing all the logging naming issue, anyway it's not related to this security issue. Let's keep this PR simple. **Release note**: ``` fix smb mount security issue ``` /sig windows /sig storage /kind bug @jessfraz /assign @jsafrane @msau42
liggitt
changed the title
|
@andyzhangx, do you still plan to work on this issue? Thanks! |
|
oh, sorry I missed that. |
|
/label official-cve-feed (Related to kubernetes/sig-security#1) |
k8s-ci-robot
added
the
official-cve-feed
This was referenced May 7, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This issue is tracked under CVE-2018-1002101
Is this a BUG REPORT or FEATURE REQUEST?:
/kind bug
What happened:
user PowerShell Environment Variables to store user input string to prevent command line injection, the env var in PowerShell would be taken as literal values and not as executable vulnerable code, this kind of fix is common for command line injection issue (called: parameterized way)
What you expected to happen:
How to reproduce it (as minimally and precisely as possible):
Anything else we need to know?:
Environment:
kubectl version):uname -a):/sig windows
/sig storage
/assign
The text was updated successfully, but these errors were encountered: